-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.12.0 bug fix and security update Advisory ID: RHSA-2022:7399-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:7399 Issue date: 2023-01-17 CVE Names: CVE-2021-4235 CVE-2021-22570 CVE-2021-38561 CVE-2022-1705 CVE-2022-2879 CVE-2022-2880 CVE-2022-2995 CVE-2022-3162 CVE-2022-3172 CVE-2022-3259 CVE-2022-3466 CVE-2022-21698 CVE-2022-24302 CVE-2022-27664 CVE-2022-30631 CVE-2022-32148 CVE-2022-32189 CVE-2022-32190 CVE-2022-41316 CVE-2022-41715 CVE-2022-42010 CVE-2022-42011 CVE-2022-42012 CVE-2022-42898 CVE-2023-0296 ===================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.12.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.0. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2022:7398 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html Security Fix(es): * golang: out-of-bounds read in golang.org/x/text/language leads to DoS (CVE-2021-38561) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879) * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) * golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190) * vault: insufficient certificate revocation list checking (CVE-2022-41316) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) * openshift: etcd grpc-proxy vulnerable to The Birthday attack against 64-bit block cipher (CVE-2023-0296) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags The sha values for the release are: (For x86_64 architecture) The image digest is sha256:4c5a7e26d707780be6466ddc9591865beb2e3baa5556432d23e8d57966a2dd18 (For s390x architecture) The image digest is sha256:ab70750be4fadf5a525141ae32a8577c91dd19f1d6e582a6824339c938216ec0 (For ppc64le architecture) The image digest is sha256:5a5943dea60b40f73ecee685b12fff1d65cc8bfe946f762fdfe862969483ddbb (For aarch64 architecture) The image digest is sha256:cb34667519d1cfd8eedf0fb27e14b7b7e6209323b86977bfaadf91da012d179d All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1843043 - Config api resource has a terrible description 1876933 - No useful message after hitting volume attachment limit 1879980 - oc adm groups prune cannot find the groups present in ldap and finishes to delete all of them 1894268 - SDN to OVN migration problem due to overlap with "Join network" 1896533 - network operator degraded due to additionalNetwork in non-existent namespace 1904106 - Graphs in dev console shouldn't go below 0 1917662 - oc exec cmd run executed file in azure file volume return 139 or exec failed: container_linux.go:366: starting container process caused: interrupted system call 1924017 - [OCPonRHV] [Workers only] Special configuration for High Performance VMs is not implemented for worker nodes 1944065 - [VPA] recommender is logging errors for pods with init containers 1944365 - openstack: missing validation for apiVIP and ingressVIP 1951835 - CVO should propagate ClusterOperator's Degraded to ClusterVersion's Failing during install 1951901 - incorrect Worker nodes number calculated when nodes have both master and worker role 1957709 - Creation of LoadBalancer service (Openstack Lbaas) take too much to be ready when creating IngressControllers with endpointPublishingStrategy=LoadBalancerService 1962502 - The route generated from ingress is still admitted after updating the spec.ingressClassName to mismatch 1977660 - the pod events show error codes when crio recreate the missing symlinks 1997396 - No alerts have triggered for CPU and Memory limit with Cluster Autoscaler 2000276 - EncryptionStateControllerDegraded: failed to get converged static pod revision 2000552 - must-gather should collect ALL apiservices 2000554 - must-gather should collect webhooks service namespaces 2001027 - ClusterAutoscaler with balanceSimilarNodeGroups does not scale even across MachineSet 2001211 - Resource usage measurement data display the concatenation of English and translation sentence fragments on utilization section when moving the mouse over each resource usage chart in Developer->Project 2001409 - All critical alerts should have links to a runbook 2006378 - improve check that verifies task permissions in vsphere 2006611 - CVO resolves the version takes a long time sometimes when upgrading via `--to-image` 2010365 - OpenShift Alerting Rules Style-Guide Compliance 2010375 - OpenShift Alerting Rules Style-Guide Compliance 2018481 - [osp][octavia lb] Route shard not consistently served in a LoadBalancerService type IngressController 2021297 - Dynamic Plugins: Console isn't honoring declared `@console/pluginAPI` dependency 2022328 - kube-controller unpublishing volume after maxWaitForUnmountDuration leaves block devices on node in a inconsistent state 2023443 - Console plugin SDK build passes even if there are errors in one of its dist packages 2028474 - [OCPonRHV] Remove clustername length limitation(metadata name) 2030406 - Dynamic plugin demo nav outputs incorrect markup that doesn't conform to the Console navigation which uses the PatternFly Navigation component 2033167 - oc extract ?to option doesn?t create the target directory if it?s not present 2033499 - Populate acceptedRisks on Recommended=False updates for conditional edges 2034883 - MCO does not sync kubeAPIServerServingCAData to controllerconfig if there are not ready nodes 2037329 - [UI] MultiClusterHub details after it's creation starts flickers, disappears and appears back (happened twice) 2039411 - Monitoring operator reports unavailable=true while one Prometheus pod is ready 2040612 - crio umask sometimes set to 0000 2043518 - Better message in the CMO degraded/unavailable conditions when pods can't be scheduled 2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter 2046335 - ETCD Operator goes degraded when a second internal node ip is added 2048349 - Service CA Operator does not reconcile for spec.loglevel changes in ServiceCA CRD 2048789 - broken toolbox in OCP 4.10 with non-default image 2049591 - [RFE] Toolbox - make sure we are running on the latest image? 2052662 - Opening Insights popup crashes the page 2055247 - [Azure] Fail to create master nodes with dcasv5 /dcadsv5 -series Confidential Virtual Machine 2055620 - ImageStreamChange triggers using annotations does not work 2056387 - [IPI on Alibabacloud][RHEL scaleup] new RHEL worker were not added into the backend of Ingress SLB automatically 2056888 - [Secondary Scheduler] - Version number incorrect in secondary scheduler operator bundle 2057637 - default VolumeSnapshotClass created by the csi-driver-manila-operator does not contain secrets 2057972 - Extra space is in the translation text(Chinese) of 'Create rolebinding' and 'replicate rolebinding' 2059125 - The oc binary for mac arm64 can?t be executed 2059599 - [ibm]Lots of info message from ibmcsidriver/identity.go:83 displayed in the log ibm-vpc-block-csi-node/iks-vpc-block-node-driver 2060068 - machine-api-provider-aws creates EC2 instances with the default security group when no matching security group is found 2060079 - Re-think kubeproxy_sync_proxy_rules_duration_seconds_bucket alerts 2061947 - IBM Cloud: Uninstall does not succeed when there is nothing to clean up 2062579 - [IBMCloud] Provide invalid profile machine stuck in "Provisioning" phase 2063764 - Operators - OperatorHub : i18n misses 2065192 - GCP - Less privileged service accounts are created with Service Account User role 2065727 - Scaling down an hypershift cluster ends with BMH shutdown and in maintenance mode 2066560 - two router pods are in ContainerCreating status when tried to patch ingress-operator with custom error code pages directly 2067059 - No topologySpreadConstraints shown in `oc describe resource` 2067323 - [sig-network-edge][Conformance][Area:Networking][Feature:Router] The HAProxy router should pass the gRPC interoperability tests [Suite:openshift/conformance/parallel/minimal] 2068910 - After node re-created, some ovn annotations are not found for the node and due to that pod is in crashloop 2070562 - Base64 data value for java keystore secret changing automatically, when we edit it from the console and saving it without doing any changes 2071792 - Non-kubeadmin user will not have access to openshift-config ns to pull secret/CM for adding private HCR in a namespace 2073617 - [IBM] allowedTopologies in SC causes scheduling to fail when region is empty 2075107 - Heading mismatch of CloudShellDrawer & Fullscreen 2075607 - [4.10] IBM VPC operator needs e2e csi tests for ibmcloud 2077933 - Kube controller manager does not handle new configurations available in the cloud provider OpenStack 2078691 - [OVN] Node to service traffic is blocked if service is "internalTrafficPolicy: Local" even backed pod is on the same node 2078727 - [IBM] Volume is not provisioned when storageclass Region is provided but without zone info 2079214 - modal text goes outside of modal boundary and doesn't have scroll bar 2079249 - list pages in pipelines is taking more time to load when there are too many items 2079679 - [bz-monitoring][invariant] alert/Watchdog must have no gaps or changes 2079690 - [RH OCP 4.9] Affinity definition YAML shows difference in web console 2080260 - 404 not found when create Image Manifest Vulnerability on Operator "Container Security" 2080449 - [Azure-file CSI Driver] Read/Write permission denied for non-admin user on azure file csi provisioned volume with fsType=ext4,ext3,ext2,xfs 2081674 - Developer add page create a new project modal redirects to admin project page after creation 2081734 - metal3-dnsmasq: workers are not provisioned during the cluster installation when BootMacAddress is not provided lower-case 2082395 - Private cluster installer on Azure asking for baseDomainResourceGroup even when it has nothing to do with basedomain as mentioned in documentation. 2082588 - [RFE] Add new Azure instance types to the official "tested/supported" list 2082599 - retry logic should have an upper bound on the number of failed attempts 2082773 - [AWS-EBS-CSI-driver-Operator] Generic ephemeral volumes online resize Filesystem type volume stucked at file system resize phase 2083041 - Updating externalTrafficPolicy=cluster to externalTrafficPolicy=local doesn't work 2083226 - alertmanager-main pods failing to start due to startupprobe timeout 2084453 - Edit PodDisruptionBudget page sometimes takes user to not synced YAML view 2084471 - Capital letters in install-config.yaml .platform.baremetal.hosts[].name cause bootkube errors 2084504 - can not silent platform alert from developer console 2085390 - machine-controller is case sensitive which can lead to false/positive errors 2086231 - Install Shared Resource CSI Driver Webhook 2086887 - DNS occasionally unavailable after large scale up operation 2087032 - Operator-sdk "run bundle" "run bundleup-grade" can't support proxy env 2087679 - EgressQoSes not gathered for debugging purposes 2087981 - PowerOnVM_Task is deprecated use PowerOnMultiVM_Task for DRS ClusterRecommendation 2088033 - Clear text password/secret in operator pod 2088583 - libguestfs: error: download: /boot/loader/entries/ostree-1-rhcos.conf: No such file or directory 2089199 - etcd Dashboard should be removed on guest cluster of hypershift 2089221 - Could not de-select a Git Secret in add and edit forms 2089402 - BuildConfig throws error when using a label with a / in it 2089807 - Many errors when powering off a master 2089950 - Upgrade fails with message Cluster operator console is not available 2090135 - [upstream] Operator-sdk run bundle offer the wrong error message 2090836 - Bootstrap node should honor http proxy 2090988 - ReplicaSet prometheus-operator-admission-webhook has timed out progressing 2091102 - Name of workload get changed, when project and image stream gets changed on edit deployment page of the workload. 2091109 - Add to application dropdown options are not visible on application-grouping sidebar action dropdown. 2091238 - NetworkPolicies: ovnkube-master pods crashing due to panic: "invalid memory address or nil pointer dereference" 2091545 - Namespace value is missing on the list when selecting "All namespaces" for operators 2091555 - Sort function doesn't work on "Namespaces" column on operator details page 2091573 - Input values in Instantiate Template are disappeared randomly in the developer console 2091864 - Registry Pod don't have "securityContext.runAsNonRoot=true" config that generated by run bundle 2092319 - [Firefox] multi-line node status formatting issue 2092731 - Give more clear information when `oc adm release new` without the --keep-manifest-list opotion for the manifestlist imagestream YAML 2092920 - Dependent tasks in Pipeline chart linked incorrectly 2093016 - [azure disk] add metric and alert to help identify cascading test failures 2093040 - unable to start `toolbox` on RHCOS using `podman` 4.0 2093046 - must-gather debug pods are missing priority class 2093440 - [sig-arch][Early] Managed cluster should start all core operators - NodeCADaemonControllerDegraded: failed to update object 2093826 - Pods with OVN hardware offloading enabled interface fail to start 2093852 - Affinity rule created in console deployment for single-replica infrastructure 2093892 - no api_key_file field in AlertmanagerConfig, but error message complains it 2094012 - Listing secrets in all namespaces with a specific labelSelector does not work properly 2094068 - No runbook created for NorthboundStale alert 2094101 - `podman` dumping core on RHCOS 4.11 + RHEL 8.6 on `aarch64` 2094174 - ReleaseAccepted=False keeps complaining about the update cannot be verified after the upgrade is cleared 2094240 - MachineConfigPool details page should use consistent word for resume updating 2094362 - Duplicate prometheus rules for API SLOs after upgrade 2094462 - DeleteACLsFromPortGroupOps doesn't actually have any UUIDs set, so it deletes nothing and complains 2094502 - Creating an MCH instance does not work via blue button 2094558 - MetalLB: Creating ip address pool and community CR through webconsole the words like addresses and communities are truncated 2094716 - Unable to install a fully air gapped OCP 4.10 cluster in AWS using IPI 2094783 - storageclass should not be created for unsupported vsphere version 2094865 - INIT container stuck forever 2095323 - Openshift on OpenStack does not honor machineNetwork setting with multiple networks 2095623 - [rebase v1.24] [sig-storage] In-tree Volumes [Driver: azure-file] tests fail 2095708 - oc adm inspect throws out erorr "the server doesn't have a resource type "egressfirewalls" for all operators 2095852 - Unable to create Network Policies: error: unexpectedly found multiple equivalent ACLs (arp v/s arp||nd) (ns_netpol1 v/s ns_netpol2) 2097026 - Administration - Cluster Settings - Cluster Operators : Filter menu values are in English 2097073 - etcdExcessiveDatabaseGrowth should not use increase() around gauge metrics 2097221 - [OVN HWOL] Avoid masked access to ct_label to allow offloading of ECMP symmetric reply and load balanced traffic 2097243 - NodeIP is used instead of EgressIP 2097431 - Degraded=True noise with: UpgradeBackupControllerDegraded: unable to retrieve cluster version, no completed update was found in cluster version status history 2097557 - can not upgrade. Incorrect reading of olm.maxOpenShiftVersion 2097691 - [vsphere] failed to create cluster if datacenter is embedded in a Folder 2097701 - MetaLLB: Validation unable to create BGPPeers with spec.peerASN Value in OCP 4.10 2097785 - Ensure OSUpdateStaged gets sent to the API server before rebooting 2098053 - Add a e2e test to validate address mismatch between pod address family and external gw family 2098054 - The control plane should tag AWS security groups at creation 2098072 - [vsphere] update install-config description for diskType 2098124 - [Kubernetes] [ISCSI] ipv6 single stack cluster could not get SCSI server host number 2098234 - Local Update Server link 404 2098299 - install-config: Strict unmarshalling conflicts with new fields 2099401 - [IBMCloud] Client does not set region endpoint for InstallConfig 2099664 - MachineConfigPool is not getting updated 2099795 - README file for helm charts coded in Chinese shows messy characters when viewing in developer perspective. 2099864 - vmware-vsphere-csi-driver-controller can't use host port error on e2e-vsphere-serial 2099939 - enabled UWM alertmanager only, user project AlertmanagerConfig is not loaded to UWM alertmanager or platform alertmanager 2099945 - [OVN] bonding fails after active-backup fail-over and reboot, kargs static IP 2099991 - pass the "--quiet" option via the buildconfig for s2i 2100166 - heterogeneous arch: oc adm extract encodes arch specific release payload pullspec rather than the manifestlisted pullspec 2100220 - Completed pods may not be correctly cleaned up 2100249 - Revert Bug 2082599: add upper bound to number of failed attempts 2100312 - should use the same value for AlertRelabelConfig with oc explain 2100334 - Event sources do not show up until KnativeServing is installed 2100342 - Operator-sdk run bundle offer the wrong error message 2100472 - TechPreview feature is not enabled, but find "failed to list *v1alpha1.AlertingRule: alertingrules.monitoring.openshift.io is forbidden" in cmo logs 2100495 - CVE-2021-38561 golang: out-of-bounds read in golang.org/x/text/language leads to DoS 2100640 - "Show operands in all namespaces" radio group font size is too large. 2100702 - No need to pass to-image-base for `oc adm release new` command when use --from-release 2100708 - Print the dup choose image message is noisy 2100774 - In the Deploy Image form Image name from external registry field Required text is not red as other fields 2100843 - Selecting add connector context menu option opens the side panel of the node 2100845 - MetalLB: matchExpressions used in CR like L2Advertisement allow duplicate entries 2100852 - worker-user-data secret couldn't be synced up from openshift-mahcine-api to openshift-cluster-api 2100860 - Users can't silence alerts from the dev console when dedicated UWM Alertmanager is deployed 2100882 - downloading govc is impacted by github rate limiting 2100918 - Add debug logging to TestIngressOperatorCacheIsNotGlobal 2100923 - [SSO] Deleting secondary scheduler CR does not delete the corresponding deployment 2101157 - OVS-Configure doesn't iterate connection names containing spaces correctly 2101343 - topolvm-controller get into CrashLoopBackOff few minutes after install 2101357 - catalog-operator fatal error: concurrent map writes 2101444 - kube-apiserver-operator should raise an alert when there is a Pod Security admission violation 2101511 - [4.12] Tag new ironic packages when we have builds 2101520 - csi-snapshot-controller-operator occasionally establishes an unusual number of watch requests 2101622 - Drain happens before other image-registry pod is ready to service requests, causing disruption 2101645 - [Cluster storage Operator] DefaultStorageClassController report fake message "No default StorageClass for this platform" on azure and openstack 2101736 - Finalizers can't be removed for machines 2101843 - pv fails to recycle with PodSecurity error 2101878 - Route status isn't always getting cleared with routeSelector updates 2101880 - [cloud-credential-operator]container has runAsNonRoot and image will run as root 2101885 - The bash completion doesn't work for get subcommand 2101992 - [Azure] IP address release: After deleting and recreating egressIP object, egress traffic was intermittently broke for about 1 minute 2102004 - 4.10 to 4.11 update: Degraded node: unexpected on-disk state: mode mismatch for file: "/etc/crio/crio.conf.d/01-ctrcfg-pidsLimit"; expected: -rw-r--r--/420/0644; received: ----------/0/0 2102098 - [OSD] There is no error message shown on node label edit modal 2102109 - co/node-tuning: Waiting for 15/72 Profiles to be applied 2102228 - Update rhcos.json in installer to point at new CDN 2102269 - The base image is still 4.10 for operator-sdk 2102324 - GCP: Panic when unknown region AND machinesets specified in install config 2102341 - [UI] ODF operator icon is missing on the Installed Operators page 2102344 - [SSO] sso operator cannot be upgraded from 1.0.0 to 1.0.1 or 1.1 2102371 - Openshift-Ansible RHEL 8 CI update 2102383 - Kube controllers crash when nodes are shut off in OpenStack 2102450 - Kernel parm needs to be added when a pao performance profile is applied, rcutree.kthread_prio=11 2102632 - a shorter cluster name leads to Uninstall fails with Observed a panic: runtime.boundsError 2102673 - FRR start race condition 2102676 - Updates / config metrics are not available in 4.11 2102766 - OCP 4.12 Using RHCOS 411.84 2103061 - [4.12] Backport Prow CI improvements from master 2103090 - Storage - StorageClasses - Create StorageClass - Provisioner: Upon selection of Provisoner i18n misses 2103126 - must-gather namespace should have ?privileged? warn and audit pod security labels besides enforce 2103144 - [IPv6] apiVIP and ingressVIP non-equality validation doesn't account for synonyms 2103178 - disabling ipv6 router advertisements using "all" does not disable it on secondary interfaces 2103224 - Sidebar perspective dropdown switcher has different background color and incorrect border color when in dark theme mode 2103236 - GCP: Error message for insufficient permissions needs to be improved 2103283 - In CI 4.10 HAProxy must-gather takes longer than 10 minutes 2103590 - [HyperShift] Election timeouts on OVNKube masters for Hypershift guests post statefulset recreation 2103668 - ovnkube-node pod fails to start - unable to add OVN masquerade route to host, error: failed to add route for subnet - after upgrading to 4.10 2103680 - Setting disableNetworkDiagnostics: true does not persist when network-operator pod gets re-created 2103725 - Carry HAProxy patch 'BUG/MEDIUM: h2: match absolute-path not path-absolute for :path' 2103786 - MCP upgrades can stall waiting for master node reboots since MCC no longer gets drained 2103940 - kube-controller-manager operator 4.11.0-rc.0 degraded on disabled monitoring stack 2103972 - Pipelines (Multi-column table) column titles are not aligned with the column content (input fields) starting with 4.9 2103981 - Topology resource sidebar shows all Builds and should show just the last n 2104275 - Supermicro server FirmwareSchema CR does not contain allowable_values, attribute_type and read_only flag 2104337 - Remove `yq` curls from CI steps 2104373 - [AWS] CCM cannot work on Commercial Cloud Services (C2S) Top Secret Region 2104481 - PROXY protocol is not configurable for "private" endpoint publishing strategy 2104503 - Update ose-machine-config-operator images to be consistent with ART 2104549 - telemeter golangci-lint outdated blocking ART PRs that update to Go1.18 2104578 - Installer creates unnecessary master_ingress_cluster_policy_controller security group rule 2104619 - Upgrade from 4.11.0-rc0 -> 4.11.0-rc.1 failed. rpm-ostree status shows No space left on device 2104642 - Add a validation webhook for Nutanix machine provider spec in Machine API Operator 2104784 - Some EgressIP was not correctly assigned to the egress node under some condition 2104803 - lr-policy-list for EgressIP was lost after scale down the test pods 2104953 - Reintroduce kube1.24 for SDN 2105003 - e2e-metal-ipi-ovn-dualstack failure: Timed out waiting for node count (5) to equal or exceed machine count (6). 2105045 - OLM updates namespace labels even if they haven't changed 2105071 - container-selinux: Mostly-confined containers which create their own user and mount namespaces can't mount overlay filesystems 2105123 - Tuned overwriting IRQBALANCE_BANNED_CPUS 2105165 - [IPI-IBMCloud] explain installconfig.platform.ibmcloud.resourceGroupName need update 2105303 - Specify the namespace and the index entry along with the chart url to get the chart details 2105325 - [oc adm release] extraction of the installer against a manifestlisted payload referenced by tag leads to a bad release image reference 2105328 - crud/other-routes.spec.ts Cypress test failing at a high rate in CI 2105341 - Bootstrap Gather Fails when cluster.tfvars.json is not available in Azure 2105344 - Console app pod action provider extension is incorrectly defined 2105399 - [SSO] secondary scheduler CR instance does not get updated when SSO is upgraded from 1.0.1 to 1.1.0 2105706 - Race condition with pendingCloudPrivateIPConfigsOps in EgressIP code 2105909 - OLM create-namespace.spec.ts e2e test fails always 2105918 - Install Helm chart form doesn't allow the user select a specific version 2105933 - OKD: update FCOS to latest stable 2105967 - Add E2E test case for Telco Friendly workload specific API 2105996 - Broken assign error display for cloudprivateipconfig 2106044 - etcd backup seems to not be triggered in 4.10.18-->4.10.20 upgrade 2106055 - vSphere defaults to SecureBoot on; breaks installation of out-of-tree drivers 2106061 - [4.12] Bootimage bump tracker 2106086 - IngressController spec.tuningOptions.healthCheckInterval validation allows invalid values such as "0abc" 2106298 - unix domain socket mode is broken when specified as ovn database transport method 2106366 - ProjectHelmChartRepository form doesn't allow the user to make a difference between name and displayname 2106372 - TypeError while creating NodeObservability Run under NodeObservability Operator 2106377 - ProjectHelmChartRepository display name (spec.name) is not used in Helm Charts catalog 2106378 - Spoke BMH stuck ?provisioning? after changing a BIOS attribute via the converged workflow 2106403 - Nutanix: the e2e-nutanix-operator webhooks test suite does not support provider Nutanix 2106444 - EgressnodeIP update need special logic to handle creation errors 2106449 - openshift4/ose-operator-registry image is vulnerable to multiple CVEs 2106476 - Order of config attributes are not maintained during conversion of PT4l from ptpconfig to ptp4l.0.config file 2106667 - UPI: Install playbooks don't honour platform.openstack.externalDNS 2106733 - Machine Controller stuck with Terminated Instances while Provisioning on AWS 2106770 - metallb greenwave tests failure 2106803 - E2E: intermittent failure is seen on tests for devfile 2106805 - Spec flag not overriding defaults in headless cypress tests 2106862 - After ovnkube-node restart, external traffic policy local no longer works 2106866 - Test Flake - Using OLM descriptor components successfully creates operand using form 2106935 - kubernetes-nmstate-operator fails to install with error "no channel heads (entries not replaced by another entry) found in channel" 2107043 - HTTPS_PROXY ENV missing in some CSI driver operators 2107068 - etcd-metrics container is flooding logs 2107113 - Adding SSH keys for core user post-install creates .ssh folder owned by root 2107178 - Bond CNI: Failed to recreate pod with active-active bond: Failed to attached links to bond: Failed to set link: net2 MASTER, master index used: 4, error: bad address 2107241 - [OCPonRHV] CSI provisioned disks are effectively preallocated due to go-ovirt-client setting Provisioned and Initial size of the disk to the same value 2107374 - CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header 2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working 2107469 - Confusing subtitle in Create Service Binding modal when the target is already known 2107513 - [SSO] 1.0.1 csv is pulling in secondary-scheduler-operator-container-v1.1-5 2107558 - When deploying via the web ui, the namespace is always openshift-operators 2107566 - [GCP] create gcpcluster get error 2107578 - Power VS machine Processor is always defaulted to 0.5 2107999 - [GCP] capg-controller-manager report panic after creating machineset and machine stuck in Provisioning 2108033 - remove ovn-kubernetes dependency on arping executable file 2108054 - Report alert when upstream CSI driver is found 2108222 - Missing spec.cpu.offlined field in v1 API 2108307 - oc debug node should set hostIPC to true 2108317 - Fix two issues in hybrid overlay 2108320 - rpm-ostreed: start limit hit easily 2108473 - [vSphere CSI driver operator] CSI controller pod restarting constantly 2108551 - [CI Watcher] Bulk Import e2e test flaking at a high rate 2108647 - [azure] Standard_D2s_v3 as worker failed by ?accelerated networking not supported on instance type? 2108708 - Ingress operator creates a "default" ingresscontroller on HyperShift 2108858 - cluster-version operator should clear (pod) securityContext when the manifest does not set the property 2109045 - ovn-k needs kubernetes 1.24 bump 2109056 - Bring avoidbuggyips back 2109059 - Reply to arp requests on interfaces with no ip 2109152 - Kube-apiserver was down and could not recover 2109258 - Legacy machine deletion annotation is not respected 2109374 - ClusterVersion availableUpdates is stale: PromQL conditional risks vs. slow/stuck Thanos 2109388 - [AWS] s3 GetBucketPolicy permission is missing in installer validation 2109469 - Code cleanup: Don't call useServiceLevelTitle hook in the JSX 2109502 - Prerelease report bug link should be updated to JIRA instead of Bugzilla 2109511 - Failed PipelineRun logs text is not visible in light mode 2109538 - Nutanix platform validations run at `create manifests` stage 2109697 - Migrate openshift-ansible to ansible-core 2109800 - [IBMCloud] context deadline exceeded for kube-scheduler targets 2109854 - Max unavailable and Max surge have inaccurate description 2109945 - HyperShift: ovnkube-node not able to connect to sbdb 2109963 - Master node in SchedulingDisabled after upgrade from 4.10.24 -> 4.11.0-rc.4 2109965 - oci hook Low-latency-hooks causing high container creation times under platform cpu load 2109967 - failed to apply dns nncp on vSphere/OpenStack platform 2110281 - daemon: Drop tuneableFCOSArgsAllowlist 2110321 - Workloads list page has different PDB action items from details page when All Projects selected 2110501 - [Upgrade]deployment openshift-machine-api/machine-api-operator has a replica failure FailedCreate 2110525 - Form/YAML form errors stay around 2110590 - Upgrade failing because restrictive scc is injected into version pod 2110617 - Split the route controllers out from OCM 2110629 - openshift-controller-manager(-operator) namespace should clear run-level annotations 2110722 - openshift-tests: allow -f to match tests for any test suite 2110927 - Edit YAML page shows unexpected zero (0) and doesn't clear errors anymore 2111151 - Cannot delete a Machine if a VM got stuck in ERROR 2111165 - Project auth cache is fully invalidated on changes to namespaces and namespaced RBAC 2111205 - console-plugin-demo build failing in CI 2111467 - Node internal DNS address is not set for machine 2111474 - Fetch internal IPs of vms from dhcp server 2111534 - [OVNK] Conntrack Rules are removed before the service rules/flows 2111537 - oc image info ignores --output for multiarch image 2111586 - Export OVS metrics 2111686 - [OKD/nanokube] Different NPE when using console with a nanokube cluster 2111733 - pod cannot access kubernetes service 2111817 - rpm-ostreed start timeout on nodes with medium/high load 2111842 - vSphere test failure: [Serial] [sig-auth][Feature:OAuthServer] [RequestHeaders] [IdP] test RequestHeaders IdP [Suite:openshift/conformance/serial] 2111878 - Azure EgressIP gives up reconciling with No matching nodes found when updating the same egressip consecutively 2111972 - openshift-machine-api namespace runlevel label should be set to empty string 2111979 - openshift-controller-manager-operator NS runlevel needs to be set to emptystring 2111984 - OpenShift controller manager needs permissions to get/create/update leases for leader election 2112086 - [hybrid-overlay] AWS EC2 metadata service not available in host's vNIC for Windows 2112146 - [CI watcher] Create pod sample fail because of a restricted pod security admission policy 2112237 - [ Cluster storage Operator 4.x(10/11/12) ] DefaultStorageClassController report fake message "No default StorageClass for this platform" on Alicloud, IBM, Nutanix 2112481 - Synced editor forms have incorrect and inconsistent visual display 2112812 - [OCP 4.10] Developer catalog fails to load (on a fully disconnected cluster and on a disconnected cluster with proxy) 2112862 - Namespace CRUD integration test is failing 2112934 - The oc adm inspect ns/[namespace_name] command is not collecting the servicemonitors in the namespace 2113936 - Fix e2e tests for [reboots][machine_config_labels] (tsc=nowatchdog) 2113977 - Fix pod stuck in termination state when mount fails or gets skipped after kubelet restart 2114009 - [4.12 Alicloud Snapshot] taking more time(4min+) to make snapshot content with ready status and (volume/snapshot content) getting created in default Resource group id 2114488 - Monitoring Alert decorator in Topology color is grey instead of red 2114506 - olm e2e failing when capabilities are disabled 2114721 - telemeter-client pod does not use the updated pull secret when it is changed 2114754 - "gather bootstrap" creates unexpected folder "serial-log-bundle-" beyond "log-bundle-.tar.gz" 2114779 - Node Tuning Operator(NTO) - OCP upgrade failed due to node-tuning CO still progressing 2114834 - Failure when creating Floating IP for load-balancer 2114968 - 4.12-nightly payloads blocked by metal jobs failing with "Still creating ..." when creating nodes 2115308 - Kube API server operator should not update replicas when Machine/Node is being removed 2115347 - 03279843 | Sev 3 | Negative regex matchers for alertmanager silences not properly parsed or read by console 2115358 - control-plane-machine-set-operator pod got panic when create cpms on a single zone deployment 2115479 - ovnkube direct-lists pods on a node when the node object changes 2115522 - Strange padding in new Helm Chart Repository table row 2115527 - ServiceAccounts PATCH noise leads to Secret leakage 2115528 - bump bootimage to include latest rpm-ostree 2115638 - CPMS cannot trigger RollingUpdate when adding failure domain 2115684 - Gather ODF CephCluster resource status 2115790 - [4.12] Bootimage bump tracker 2115799 - CI failing tests: Perform actions on knative service and revision knative service menu options 2115802 - Minor test fixes related to getting updated profile and checking kubeletconfiguration 2115814 - Issues with samples in a disconnected cluster in OCP 4.9 2115899 - BuildConfig form: Docker image repository should be just called Image registry 2116382 - Setting a telemeter proxy in the cluster-monitoring-config config map does not work as expected 2116415 - CI failing tests: Event tab in build details page 2116460 - percpu Memory leak CRIO due to no garbage collection in /run/crio/exits for exited containers 2116547 - phyc2sys config will be automatically added to ptpconfigs even if it is not included in user PGT 2116715 - remove dead code from openshift-controller-manager 2116973 - Multiple navigation items displaying as active 2116982 - multus-admission-controller in openshift-multus has 2 replicas on SNO 2117033 - Cluster-version operator ClusterOperator checks are unecessarily slow on update 2117142 - Update the permission for Project Helm Chart Repository 2117235 - separate route controllers to a new command 2117255 - Failed to dump flows for flow sync, stderr: "ovs-ofctl: br-ext is not a bridge or a socket" 2117310 - [OVN] New pods unable to establish TCP connections and get constant timeouts causing application downtime 2117387 - vsphere: installer for vsphere does not have steal clock accounting enabled 2117423 - Backport: https://github.com/openshift/kubernetes/pull/1295 2117439 - change controlplanemachineset machineType to other type trigger RollingUpdate cause cluster error 2117474 - ccoctl panics while trying to create a secret from credential request which does not have providerspec within it 2117524 - openshift-ingress-operator with mTLS does not download CRL 2117569 - kube-controller-manager needs to stop watching all events 2117595 - Upgrade golangci-lint to 1.47.3 in image-customization-controller 2117602 - LocalVolume does support by-path volumes 2117646 - Changing `spec.host` field on any of routes in the openshift-console namespace wont trigger sync loop 2117738 - Plugin page error boundary message is not cleared after leaving page 2117749 - Bump to latest k8s.io 1.24 release 2117822 - oc adm release extract should handle ccoctl 2118286 - KCMO should not be dependent on monitoring stack 2118318 - kube-controller-manager resource quota controller needs to stop watching all events 2118550 - [capi] azure and vsphere image in payload 2118563 - [OSP][SDN] The displayed IP Capacity is not consistent with port allowed maximum addresses 2118625 - [Nutanix] ccoctl panics if nutanix credentials source file and openshift credentials requests files are in the same directory 2124668 - CVE-2022-32190 golang: net/url: JoinPath does not strip relative path components in all circumstances 2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers 2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters 2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps 2135339 - CVE-2022-41316 vault: insufficient certificate revocation list checking 2161287 - CVE-2023-0296 openshift: etcd grpc-proxy vulnerable to The Birthday attack against 64-bit block cipher 5. JIRA issues fixed (https://issues.jboss.org/): OCPBUGS-1000 - Allow scale-down of unhealthy member when it doesn't violate quorum OCPBUGS-1004 - The error message of "opm alpha render-veneer semver" is not correct OCPBUGS-1017 - Can't cancel login when using multi-cluster OCPBUGS-1029 - Developer catalog fails to load OCPBUGS-1038 - Whereabouts reconciliation should be launched by the CNO when using a conflist OCPBUGS-1044 - There's an issue with node-exporter pods running when using a bare metal AMD EPYC setup OCPBUGS-1049 - Pod security policy change breaks cluster-ingress-operator's TestCanaryRoute E2E tests OCPBUGS-1067 - [vsphere-CSI-Driver-Operator] The storageclass "thin-csi" could not be re-created after deleting OCPBUGS-1068 - Correct namespace for SimpleContentAccessNotAvailable OCPBUGS-1069 - Update ODC owners OCPBUGS-1076 - CNO in HyperShift management cluster is reconciling ovn-kubemaster in Hosted Control Plane namespace. OCPBUGS-1080 - It's not possible to share BMC secrets between BareMetalHosts OCPBUGS-1083 - e2e-aws-ovn-serial fails because of OVNKubernetesControllerDisconnectedSouthboundDatabase OCPBUGS-1105 - Import a Devfile on a disconnected cluster with a proxy doesn?t work OCPBUGS-1106 - Devfile Catalog and Import a Devfile on a fully disconnected cluster should fail directly instead of timeout after 30sec OCPBUGS-1132 - e2e: perfprof: unbreak the e2e-gcp PAO lane OCPBUGS-122 - Error: open /etc/nsswitch.conf: permission denied and Error: open ./db-609956243: permission denied OCPBUGS-1226 - OpenStack UPI scripts do not create server group for Computes OCPBUGS-1227 - Node events create unnecessary CPU load OCPBUGS-1231 - base image can't be fetched in a disconnected environment OCPBUGS-1234 - AWS tagging limit hit issue when trying to add more than 10 tags OCPBUGS-1237 - e2e-gcp-builds is permafailing OCPBUGS-1244 - Add PowerVS region mon01 to installer OCPBUGS-1247 - AWS Control Plane machine set are breaking single node clusters OCPBUGS-1256 - [CI-Watcher] e2e issue with tests: Using OLM descriptor components. Using OLM descriptor components deletes operand OCPBUGS-1257 - Keepalived health check causes unnecessary VIP flapping when HAProxy is healthy OCPBUGS-1263 - cri-o should report the stage of container and pod creation it's stuck at OCPBUGS-1268 - HelmChartRepositories has no action menu if the default repo is disabled OCPBUGS-1274 - machine-api-termination-handler Pods don't launch on tainted spot instances OCPBUGS-1290 - Update Kafka Sink text description OCPBUGS-1318 - Dual stack cluster fails on installation when multi-path routing entries exist OCPBUGS-1321 - node_exporter collects metrics for "virtual" network interfaces OCPBUGS-1324 - Clusters with a custom osImage cannot be upgraded OCPBUGS-1329 - etcd and kube-apiserver pods get restarted due to failed liveness probes while deleting/re-creating pods on SNO OCPBUGS-1351 - health_statuses_insights metrics is showing disabled rules in "total" OCPBUGS-1353 - ETCD Operator goes degraded when a second internal node ip is added OCPBUGS-1361 - Expect more detail info when report vSphere privilege alert OCPBUGS-1364 - Improve prometheus-adapter consistency OCPBUGS-1402 - panic in cvo pod OCPBUGS-1409 - E2E: intermittent failure is seen on tests for devfile OCPBUGS-1416 - ODC add-page e2e tests doesn't pass (outdated checks) OCPBUGS-1417 - Disconnected Openshift cluster on AWS having problem with manual egress IP assignment OCPBUGS-1421 - Document how to use RWX vSphere volumes OCPBUGS-1429 - get updated rpm-ostree in 4.12 bootimages OCPBUGS-1434 - Downstream Autoscaling Eviction Annotation to OCP 4.12 OCPBUGS-1437 - OLM Reports ResolutionFailed when there are multiple upgrade paths between channel entries OCPBUGS-1456 - Cluster operator-related tests failing on techpreview because of "platform-operators-aggregated" OCPBUGS-1470 - i18n: Incorrect plural for maxUnavailable pod count OCPBUGS-1479 - PDB list page should only show Create Pod button to user has sufficient permission OCPBUGS-1482 - Can't install clusters with schedulable masters OCPBUGS-1484 - Remove policy/v1beta1 in 4.11 and later OCPBUGS-1489 - [vsphere] one vm folder is not deleted when destroying ocp cluster configured region/zone OCPBUGS-1498 - e2e: performance: Verify kernel param rcutree.kthread OCPBUGS-1502 - PodNetworkConnectivityCheck gatherer reads too much data into memory OCPBUGS-1503 - configure-ovs.sh fails on unrelated, invalid connection files (non-existing interfaces) OCPBUGS-1505 - Booting live ISO: /dev/sr0 already mounted or mount point busy OCPBUGS-1512 - [OCP 4.12] Fix generate script in CBO OCPBUGS-1515 - Join network CIDR not accept v6InternalSubnet fdxx::/48 OCPBUGS-1522 - Regular user cannot open the debug container from pods they created OCPBUGS-1533 - sdn rebase to 1.25 OCPBUGS-1549 - DNS operator does not reconcile the openshift-dns namespace OCPBUGS-1554 - Bump cluster-ingress-operator to k8s 1.25 OCPBUGS-1558 - Bump cluster-dns-operator to k8s 1.25 OCPBUGS-1569 - OBC and OB option showing twice to user of a Project on Console OCPBUGS-1570 - Event Sources not shown in topology OCPBUGS-1616 - masters unavailable & mco degraded in bootstrap techpreview jobs OCPBUGS-1621 - The CSV of the operator does not have timestamp OCPBUGS-1629 - Facing issue while configuring egress IP pool in OCP cluster which uses STS OCPBUGS-1636 - The platform-operators-aggregated cannot be created after enabling TechPreviewNoUpgrade OCPBUGS-1641 - irqbalance: add unit to clear the cpu ban list OCPBUGS-1645 - CPMS should handle clusters where Masters are not indexed from 0 OCPBUGS-165 - Spike in pod-latency graph observed due to ovnkube-master restarts OCPBUGS-1677 - CI: Backend unit tests fails because devfile registry was updated (fix assertion) OCPBUGS-1678 - CI: Backend unit tests fails because devfile registry was updated (mock response) OCPBUGS-169 - Console e2e tests broken due to pod security admission controller OCPBUGS-1698 - [vsphere] Installer get panic error when no setting platform.vsphere.failureDomains.topology.networks OCPBUGS-1705 - OVN-Kubernetes master crashing due to too long ACL names during upgrade OCPBUGS-1708 - console.openshift.io/use-i18n false in v1alpha API is converted to "" in the v1 APi, which is not a valid value for the enum type declared in the code.? OCPBUGS-171 - VirtualMediaViaExternalNetwork is broken with virtual media TLS OCPBUGS-1717 - Image registry panics while deploying OCP in me-central-1 AWS region OCPBUGS-1718 - prometheus-k8s-0 ends in CrashLoopBackOff with evel=error err="opening storage failed: /prometheus/chunks_head/000002: invalid magic number 0" on SNO after hard reboot tests OCPBUGS-1730 - Bump openshift-router to k8s 1.25 OCPBUGS-1731 - Rebase CoreDNS to 1.10.0, based on k8s 1.25 OCPBUGS-1736 - cncc crashloop in proxy deployments OCPBUGS-1746 - Update the Github App events and permissions OCPBUGS-1776 - Duplicate "Getting Started" notification will show on Search page for normal user OCPBUGS-1789 - Users can't silence alerts from the dev console when dedicated UWM Alertmanager is deployed OCPBUGS-1799 - Ironic API proxy pods crash loop if IPv6 is used OCPBUGS-180 - Name of "Role" should keep pace with the name in CLI OCPBUGS-1806 - OCP cluster install on baremetal fails when hostname of master nodes does not include the text "master" (take 2) OCPBUGS-1810 - must gather for gather_ingress_node_firewall breaks with permission issues OCPBUGS-1824 - Systemd service been deactivated in limited network environment OCPBUGS-1825 - Ingress Node Firewall rule becomes non-functional when daemons and controller manager deployment are re-deployed OCPBUGS-1827 - knative service e2e tests are failing OCPBUGS-183 - Log line numbers overlap with cut-off rule when number is too big OCPBUGS-1831 - failed to run command in pod with network-tools script pod-run-netns-command locally OCPBUGS-184 - [OCP web console] Wrong message "404: Not found" while the user selects an installed operator and navigates from operator hub to installed operator page. OCPBUGS-1853 - [OVNK] ARP doesn't exist for v6: https://github.com/j-keck/arping/ OCPBUGS-1856 - [IBMCloud] install private cluster need manually add a rule to the security group for *sg-kube-api-lb OCPBUGS-1877 - download 'aliyun' OCPBUGS-1880 - Openshift version upgrade cause multiple worker go in draining node OCPBUGS-1881 - [vSphere] cluster destroy get stuck if vm have not tag attached OCPBUGS-1896 - [CORS-2260] "create install-config" got error 'credentialsMode: Forbidden: environmental authentication is only supported with Manual credentials mode' OCPBUGS-1900 - Bootstrap error in SNO installation OCPBUGS-1904 - CSI driver operators are degraded without "CSISnapshot" capability OCPBUGS-1912 - downstream `opm alpha diff` moving to `oc-mirror` OCPBUGS-1913 - Agent Installer: Do not fail on deprecated apiVip and ingressVip values OCPBUGS-1916 - Workloads list page has different HPA action items from details page when All Projects selected OCPBUGS-193 - Kebab menu not working properly for helm repository OCPBUGS-194 - Layout for API Explorer page is incorrect OCPBUGS-1941 - [4.12] Bootimage bump tracker OCPBUGS-1949 - kube-controller log gatherer should limit number of bytes read OCPBUGS-1950 - Devfile samples (in Developer Catalog) link doesn't include the current selected namespace OCPBUGS-1962 - Controller and speakers are not created with tolerations effect is NoScheduleNoSchedule and tolerationSeconds is set 10 OCPBUGS-1979 - Update openshift/etcd Go version to 1.16 OCPBUGS-198 - Kuryr-Controller Restarting on KuryrPort with missing pod OCPBUGS-1992 - [osp][octavia lb] failing to create floating IP for external LB OCPBUGS-1994 - Unrevert needed for jsonnet deps update PR OCPBUGS-2004 - egressip healthcheck through GRPC on dualstack cluster only uses v6 address when trying to re-connect to egressIP node OCPBUGS-2009 - User should be warned that MetalLB controller pod config node affinity cannot have weight 0 OCPBUGS-2010 - [noop][4.12] ironic clear_job_queue and reset_idrac pending issues OCPBUGS-2029 - proxy config in installconfig fails to be applied OCPBUGS-2052 - [4.12] boot sequence override request fails with Base.1.8.PropertyNotWritable on Lenovo SE450 OCPBUGS-2063 - List pages in pipelines is taking more time to load when there are too many items OCPBUGS-2071 - revert "force cert rotation every couple days for development" in 4.12 OCPBUGS-2075 - Do not show notification switch for the alert rule which have no alerts associated OCPBUGS-2076 - CI AWS CCM cluster install failure OCPBUGS-2079 - systemReserved:ephemeral-storage in KubeletConfig doesn't work as expected OCPBUGS-208 - Race condition when creating / deleting mac_address_pairs OCPBUGS-2086 - Detect failure to prepare installation OCPBUGS-2100 - Alert icon color is black in the Topology list view OCPBUGS-2102 - Resource quota e2e tests fails after latest changes to master OCPBUGS-212 - co/kube-controller-manager degraded: GarbageCollectorDegraded: error fetching rules: Get "https://thanos-querier.openshift-monitoring.svc:9091/api/v1/rules": dial tcp 172.30.153.28:9091: connect: cannot assign requested address OCPBUGS-2122 - machine-config-daemon failed to update the OS for cluster running behind proxy OCPBUGS-2125 - CVO skips reconciling the installed optional resources in the 4.11 to 4.12 upgrade OCPBUGS-2138 - Get OSImageURL override related metric data available in telemetry OCPBUGS-2151 - machine-api-operator degraded during 3+1 deployment due to minimum worker replica count is 2 OCPBUGS-2152 - RHCOS VM fails to boot on IBM Power (ppc64le) - 4.12 OCPBUGS-2155 - Etcd scaling test was mistakenly added to the parallel suite OCPBUGS-2157 - Documentation for cleaning crio produces kubelet errors OCPBUGS-2158 - Track changes of serviceAccountIssuer in operator status OCPBUGS-216 - kuryr-controller timing out liveness probe OCPBUGS-2167 - Workload hints feature breaks backwards compatibility OCPBUGS-2175 - Windows to linux networking broken since downstream OVN merge OCPBUGS-2181 - e2e tests: Installs Red Hat Integration - 3scale operator test is failing due to change of Operator name OCPBUGS-2195 - NPE on visiting topology for ns which got deleted OCPBUGS-2197 - [upgrade 4.11.z to 4.12 nightly] rpm-ostree update via container failed OCPBUGS-2219 - ConsolePlugin CRs cannot be garbage collected due to missing spec.i18n.loadType value OCPBUGS-2223 - Default catalogSources are not updated to 4.12 OCPBUGS-2227 - VPA Operator not enabled in 4.12 OCPBUGS-224 - Missing $SEARCH domain in /etc/resolve.conf for OCP v4.9.31 cluster OCPBUGS-2249 - Conditional gatherer cluster_version_matches issues OCPBUGS-2262 - [gcp][CORS-1774] "platform.gcp.publicDNSZone" and "platform.gcp.privateDNSZone" should be for existing DNS zones OCPBUGS-2265 - Allow passing documentation links for alerts OCPBUGS-2269 - "error: No enabled repositories" on upgrade with kernelType: realtime enabled OCPBUGS-2301 - [gcp][CORS-1774] with "createFirewallRules: Enabled", after successful "create cluster" and then "destroy cluster", the created firewall-rules in the shared VPC are not deleted OCPBUGS-2316 - Ingress-node-Firewall:Mixing ICMP v4 and v6 config causes a panic OCPBUGS-2322 - Kuryr does not accept application credentials OCPBUGS-2325 - Add e2e test cases for INF spec.ingress OCPBUGS-2327 - Add validation for releaseImage and mirror OCPBUGS-2328 - Panic observed: runtime error: index out of range OCPBUGS-2330 - events.events.k8s.io is forbidden: User "system:serviceaccount:openshift-kube-descheduler-operator:openshift-descheduler-operand" cannot create resource "events" in API group "events.k8s.io" in the namespace "e2e-test-default-b6y9atnu-jxz6p" OCPBUGS-2334 - NE-956: Configurable LB Source Ranges breaks TestScopeChange OCPBUGS-2338 - Confusing error messages when missing VIPs OCPBUGS-2340 - OnDelete update strategy cannot work when master machines are not index as 0, 1, 2 OCPBUGS-2346 - Remove namespace and name from gathered DVO metrics OCPBUGS-2354 - co/storage is not available due to csi driver not have proxy setting on ibm cloud OCPBUGS-236 - custom ingress-controller can't be deleted OCPBUGS-2360 - [IPI on Baremetal] ipv6 support issue in metal3-httpd OCPBUGS-2362 - OVN-K alerts must be set to the correct severity level OCPBUGS-2369 - NPE on topology if creates a k8s svc and KSVC which has no metadata in template OCPBUGS-2372 - Duplicate addresses when the controller is restarted OCPBUGS-2373 - When changing a lb service to another type, the freed ip is not reused OCPBUGS-238 - ReEnable e2e tests for knative OCPBUGS-2396 - FIPS jobs are broken after images rebuilt with golang 1.19 OCPBUGS-2435 - Nil-pointer dereference in TestRouterCompressionOperation on e2e-gcp-operator OCPBUGS-2436 - Installer fails to create ingress.config.openshift.io/cluster on AWS because of missing spec.loadBalancer.platform.aws.type OCPBUGS-2437 - Clusters with large numbers of CSVs can cause crashloop, block upgrades OCPBUGS-2438 - Help popovers cause error on Observe > Alerting pages OCPBUGS-2446 - Control Plane Machine Set does not expose errors OCPBUGS-2455 - Pods and PDBs list page just reports 'Not found' when no Pod/PDB OCPBUGS-246 - Incorrect retry cause false positive in CNF tests OCPBUGS-2469 - ControlPlaneMachineSets are not included in must-gathers OCPBUGS-2478 - i18n translation missing in "Remove component node from application" modal OCPBUGS-2495 - 'oc login' should be robust in the face of gather failures OCPBUGS-2508 - Worker creation fails within provider networks (as primary and secondary) OCPBUGS-2512 - apiserver pods cannot reach etcd on single node IPv6 cluster: transport: authentication handshake failed: x509: certificate is valid for ::1, 127.0.0.1, ::1, fd69::2, not 2620:52:0:198::10" OCPBUGS-2558 - [RFE] Add new Azure instance types to the official "tested/supported" list OCPBUGS-256 - intra namespace allow network policy doesn't work after applying ingress&egress deny all network policy OCPBUGS-2592 - CVO hot-loops on Deployment manifests OCPBUGS-262 - downloading govc is impacted by github rate limiting OCPBUGS-2621 - Enable TechPreview cause cluster error on single node cluster OCPBUGS-2635 - Ingress operator degraded during 3+1 deployment due to insufficient worker nodes OCPBUGS-2638 - Switch libvirt VM's to vnc graphic mode OCPBUGS-2651 - Pipeline Run nodes should show focus border OCPBUGS-2654 - Console OLM Integration Tests Reference Operator Not Present in 4.12 Certified Operators CatalogSource OCPBUGS-2656 - VPA E2Es fail due to CSV name mismatch OCPBUGS-268 - vsphere: installer for vsphere does not have steal clock accounting enabled OCPBUGS-270 - Dev Catalog taking too much time to load in a complete disconnected cluster OCPBUGS-2726 - Descheduler SoftTopologyAndDuplicates uses Stategy RemovePodsViolatingTopologySpreadConstraint which has invalid mapping OCPBUGS-2741 - CPMS failureDomains is not keep consistent with master machines on heterogeneous cluster after upgrade from 4.11 to 4.12 OCPBUGS-2757 - rebase should handle idempotency OCPBUGS-2774 - [AWS][GCP] the new created nodes are not added to load balancer OCPBUGS-2775 - After added/removed label from a namespace, one stats of "route_metrics_controller_routes_per_shard" in Observe >> Metrics page aren't correct OCPBUGS-2779 - Import: Advanced option sentence is splited into two parts and headlines has no padding OCPBUGS-2803 - Project auth cache sync blocks list handler OCPBUGS-2822 - [4.12] EFS csi controller&driver pod are CrashLoopBackOff due to csi-driver container is not running on arm. OCPBUGS-2826 - ovnkube-trace: ofproto/trace fails for IPv6 OCPBUGS-2837 - Excessive debug logs OCPBUGS-2848 - Routes per shard metric inaccurate if using matchExpression OCPBUGS-2854 - Controlplanmachineset couldn't be created after deleting a machineset OCPBUGS-2874 - Add Capacity button does not exist after upgrade OCP version [OCP4.11->OCP4.12] OCPBUGS-2896 - Refactor retry logic into a separate pkg OCPBUGS-2909 - Invalid documentation link in knative-plugin README OCPBUGS-2915 - InsightsRecommendationActive should link cluster-specific page OCPBUGS-2918 - Update Prometheus Alerts OCPBUGS-2927 - CI jobs are failing with: admission webhook "validation.csi.vsphere.vmware.com" denied the request OCPBUGS-2974 - administrator console, monitoring-alertmanager-edit user list or create silence, "Observe - Alerting - Silences" page is pending OCPBUGS-2975 - PTP 4.12 - PTP - AMQ HTTP on event caused ptp stopped working after fresh deployment OCPBUGS-2979 - [4.12] automatic replacement of an unhealthy member machine OCPBUGS-2984 - [RFE] 4.12 Azure DiskEncryptionSet static validation does not support upper-case letters OCPBUGS-2995 - [4.12] Unable to gather OpenStack console logs since kernel cmd line has no console args OCPBUGS-2997 - [4.12] Bootimage bump tracker OCPBUGS-2998 - OCP 4.12 Driver Toolkit (DTK) mismatch in kernel package and node kernel versions OCPBUGS-3003 - Ignore non-ready endpoints when processing endpointslices OCPBUGS-3019 - Ingress node firewall pod 's events container on the node causing pod in CrashLoopBackOff state when sctp module is loaded on node OCPBUGS-302 - openshift-install gather bootstrap panics OCPBUGS-3022 - GCP: missing multiple regions OCPBUGS-3028 - panic in WaitForBootstrapComplete OCPBUGS-3035 - 4.12 backport: Multiple extra manifests in the same file are not applied correctly OCPBUGS-3037 - [apiserver-auth] default SCC restricted allow volumes don't have "ephemeral" caused deployment with Generic Ephemeral Volumes stuck at Pending OCPBUGS-305 - Cluster-version operator ClusterOperator checks are unecessarily slow on update OCPBUGS-3055 - 4.12 backport: Wait-for install-complete did not exit upon completion. OCPBUGS-3071 - [4.12][AWS] curl network Loadbalancer always get "Connection time out" OCPBUGS-3075 - [4.12] ovn-k network policy races OCPBUGS-3080 - [4.12] RPS hook only sets the first queue, but there are now many OCPBUGS-3081 - monitor not working with UDP lb when externalTrafficPolicy: Local OCPBUGS-3094 - [4.12] The control plane should tag AWS security groups at creation OCPBUGS-3111 - metal3 pod crashloops on OKD in BareMetal IPI or assisted-installer bare metal installations OCPBUGS-3115 - [2117255] Failed to dump flows for flow sync, stderr: "ovs-ofctl: br-ext is not a bridge or a socket" OCPBUGS-3175 - CIRO unable to detect swift when it speaks HTTP2 OCPBUGS-3177 - RHCOS 4.12/s390x kdump is failling, disable test OCPBUGS-3179 - Regression in ptp-operator conformance tests OCPBUGS-3194 - [4.12.z backport][4.8][OVN] RHEL 7.9 DHCP worker ovs-configuration fails OCPBUGS-3204 - Permission denied when write data to mounted gcp filestore volume instance OCPBUGS-3208 - [4.12] SCOS build fails due to pinned kernel OCPBUGS-3249 - CVE-2022-27191 ose-installer-container: golang: crash in a golang.org/x/crypto/ssh server [openshift-4] OCPBUGS-3263 - The terraform binaries shipped by the installer are not statically linked OCPBUGS-3265 - Console shouldn't try to install dynamic plugins if permissions aren't available OCPBUGS-3276 - Pin down dependencies on CMO release 4.12 OCPBUGS-3279 - Service-ca controller exits immediately with an error on sigterm OCPBUGS-3281 - OCP 4.10.33 uses a weak 3DES cipher in the VMWare CSI Operator for communication and provides no method to disable it OCPBUGS-3289 - [IBMCloud] Worker machines unreachable during initial bring up OCPBUGS-3293 - WriteRequestBodies audit profile records routes/status events at RequestResponse level OCPBUGS-3297 - Bugfix in privileged-daemonset and better dependencies OCPBUGS-3306 - Agent installer does not support dualstack VIPs OCPBUGS-3307 - [gcp] when the optional Service Usage API is disabled, IPI installation cannot succeed OCPBUGS-3311 - [alibabacloud] IPI installation failed with master nodes being NotReady and CCM error "alicloud: unable to split instanceid and region from providerID" OCPBUGS-3333 - Console should be using v1 apiVersion for ConsolePlugin model OCPBUGS-3340 - Environment cannot find Python OCPBUGS-3343 - [vsphere] installation fails when setting user-defined folder in failure domain OCPBUGS-3346 - [perf/scale] libovsdb builds transaction logs but throws them away OCPBUGS-3348 - 4.12: When adding nodes, the overlapped node-subnet can be allocated. OCPBUGS-3352 - ClusterVersionRecommendedUpdate condition blocks explicitly allowed upgrade which is not in the available updates OCPBUGS-3359 - Revert BUILD-407 OCPBUGS-3363 - openshift-ingress-operator with mTLS does not download CRL OCPBUGS-3366 - Disconnected cluster installation fails with pull secret must contain auth for "registry.ci.openshift.org" OCPBUGS-3378 - [OVN]Sometimes after reboot egress node, egress IP cannot be applied anymore. OCPBUGS-3379 - [release-4.12] CephCluster and StorageCluster resources use the same paths OCPBUGS-3390 - [release-4.12] 4.11 SNOs fail to complete install because of "failed to get pod annotation: timed out waiting for annotations: context deadline exceeded" OCPBUGS-3397 - Avoid re-metric'ing the pods that are already setup when ovnkube-master disrupts/reinitializes/restarts/goes through leader election OCPBUGS-3398 - 4.12 backport: Unable to configure cluster-wide proxy OCPBUGS-3406 - [gcp][CORS-1774] with both "id" and "project" specified for "privateDNSZone", it seems installer doesn't horner "project" OCPBUGS-3425 - [release-4.12] Azure Disk CSI Driver Operator gets degraded without "CSISnapshot" capability OCPBUGS-3428 - [4.12] Skip broken [sig-devex][Feature:ImageEcosystem] tests OCPBUGS-3436 - domain 24 missing from phc2sys options OCPBUGS-3437 - cloud-network-config-controller not using proxy settings of the management cluster OCPBUGS-3442 - Datastore name is too long OCPBUGS-3443 - [4.12] Descheduler pod is OOM killed when using descheduler-operator profiles on big clusters OCPBUGS-3455 - track `rhcos-4.12` branch for fedora-coreos-config submodule OCPBUGS-3459 - Installer does not always add router CA to kubeconfig OCPBUGS-346 - Failed to create volumesnapshotcontent for gcp-filestore-csi-driver-operator OCPBUGS-3464 - IBM operator needs deployment manifest fixes OCPBUGS-3468 - Disable check_pkt_length in OVN-K for OvS Hardware Offload Cases OCPBUGS-3479 - [4.12] Baremetal Provisioning fails on HP Gen9 systems due to eTag handling OCPBUGS-3483 - Minor test fixes related to getting updated profile and checking kubeletconfiguration OCPBUGS-3493 - [Ingress Node Firewall Operator] [Web Console] Allow user to override namespace where the operator is installed, currently user can install it only in openshift-operators ns OCPBUGS-3503 - CRD-based and openshift-apiserver-based Route validation/defaulting must use the shared implementation OCPBUGS-3504 - [4.12] Incorrect network configuration in worker node with two interfaces OCPBUGS-3510 - Update cluster-authentication-operator not to go degraded without console OCPBUGS-3515 - Need validation rule for supported arch OCPBUGS-3519 - Assisted service should always use first matching mirror for release image OCPBUGS-3520 - Install ends in preparing-failed due to container-images-available validation OCPBUGS-3523 - Operator attempts to render both GA and Tech Preview API Extensions OCPBUGS-3557 - [4.12] provisioning of baremetal nodes fails when using multipath device as rootDeviceHints OCPBUGS-3571 - Placeholder bug for OCP 4.12.0 metadata release OCPBUGS-3639 - The architecture field in sig image definition for hyperVGeneration V1 needs to match rhcos_image architecture OCPBUGS-364 - Update ose-baremetal-installer images to be consistent with ART OCPBUGS-3650 - EUS upgrade stuck on worker pool update: error running skopeo inspect --no-tags OCPBUGS-3651 - DaemonSet "/openshift-network-diagnostics/network-check-target" is not available OCPBUGS-3658 - OVN-Kubernetes should not send IPs with leading zeros to OVN OCPBUGS-3663 - don't enforce PSa in 4.12 OCPBUGS-3694 - [4.12] Router e2e: drop template.openshift.io apigroup dependency OCPBUGS-3696 - Surface ClusterVersion RetrievedUpdates condition messages OCPBUGS-3700 - [osp][octavia lb] NodePort allocation cannot be disabled for LB type svcs OCPBUGS-3754 - Create Alertmanager silence form does not explain the new "Negative matcher" option OCPBUGS-3763 - PTP operator: Use priority class node critical OCPBUGS-3770 - cvo pod crashloop during bootstrap: featuregates: connection refused OCPBUGS-3772 - Default for spec.to.weight missing from Route CRD schema OCPBUGS-3774 - Unable to use application credentials for Cinder CSI after OpenStack credentials update OCPBUGS-3780 - Route CRD validation behavior must be the same as openshift-apiserver behavior OCPBUGS-3786 - Should show information on page if the upgrade to a target version doesn't take effect. OCPBUGS-3798 - [4.12] Bump OVS control plane to get "ovsdb/transaction.c: Refactor assess_weak_refs." OCPBUGS-3811 - Automation Offline CPUs Test cases OCPBUGS-3824 - [4.12] Ipsec pods restart due to liveness probes fail in cluster with more than 150 + OCPBUGS-3837 - service account token secret reference OCPBUGS-384 - GCP Filestore csi operator has wrong spec.description in csv files OCPBUGS-3841 - Remove flowcontrol/v1beta1 release manifests in 4.12 and later OCPBUGS-3851 - [4.12][Dual Stack] ovn-ipsec crashlooping due to cert signing issues OCPBUGS-3871 - Container networking pods cannot be access hosted network pods on another node in ipv6 single stack cluster OCPBUGS-3874 - masters repeatedly losing connection to API and going NotReady OCPBUGS-3875 - Route CRD host-assignment behavior must be the same as openshift-apiserver behavior OCPBUGS-3878 - RouteTargetReference missing default for "weight" in Route CRD v1 schema OCPBUGS-3881 - Revert Catalog PSA decisions for 4.12 OCPBUGS-3884 - [Ingress Node Firewall] Change the logo used for ingress node firewall operator OCPBUGS-3889 - Egress router POD creation is failing while using openshift-sdn network plugin OCPBUGS-3890 - [ibmcloud] unclear error msg when zones is not match with the Subnets in BYON install OCPBUGS-3899 - [2035720] [IPI on Alibabacloud] deploying a private cluster by 'publish: Internal' failed due to 'dns_public_record' OCPBUGS-392 - Setting disableNetworkDiagnostics: true does not persist when network-operator pod gets re-created OCPBUGS-3927 - "Error loading" when normal user check operands on All namespaces OCPBUGS-3930 - Local Storage Operator (LSO) not available in OperatorHub for OCP 4.12 on Z ec.5 and rc.0 builds OCPBUGS-3944 - Handle 0600 kubeconfig OCPBUGS-3956 - CNO reporting incorrect status OCPBUGS-3958 - [4.12] Use kernel-rt from ose repo OCPBUGS-3966 - must-gather namespace should have ?privileged? warn and audit pod security labels besides enforce OCPBUGS-4001 - fix operator naming convention OCPBUGS-4004 - Consistent e2e test failure:Events.Events: event view displays created pod OCPBUGS-4013 - On Make Serverless page, to change values of the inputs minpod, maxpod and concurrency fields, we need to click the ? + ? or ? - ', it can't be changed by typing in it. OCPBUGS-4035 - Topology gets stuck loading OCPBUGS-4040 - Authentication operator doesn't respond to console being enabled OCPBUGS-4043 - [2109965] oci hook Low-latency-hooks causing high container creation times under platform cpu load OCPBUGS-4048 - Prometheus doesn't reload TLS certificate and key files on disk OCPBUGS-4063 - Fails to deprovision cluster when swift omits 'content-type' OCPBUGS-4064 - Install failure in create-cluster-and-infraenv.service OCPBUGS-4068 - Shouldn't need to put host data in platform baremetal section in installconfig OCPBUGS-407 - [2116382] Setting a telemeter proxy in the cluster-monitoring-config config map does not work as expected OCPBUGS-4083 - CCM not able to remove a LB in ERROR state OCPBUGS-4097 - [IPI-BareMetal]: Dual stack deployment failed on BootStrap stage OCPBUGS-4098 - [4.12] Egress IP Health Check Is Not Compatible With VF (Hardware Backed) Management Port OCPBUGS-4112 - Remove autoscaling/v2beta2 in 4.12 and later OCPBUGS-4116 - Re-enable pipeline CI tests OCPBUGS-4117 - Re-enable serverless CI tests OCPBUGS-4118 - Kube-State-metrics pod fails to start due to panic OCPBUGS-4121 - [SNO] csi-snapshot-controller CO is degraded when upgrade from 4.12 to 4.13 and reports permissions issue. OCPBUGS-416 - [IBMCloud] The udevadm utility is missing in the IBM Cloud VPC block storage IPI image OCPBUGS-418 - [OCP web console] Search result doesn't clear when user clears name filter in one-shot for any resources OCPBUGS-4183 - Upgrades from 4.11.9 to latest 4.12.x Nightly builds do not succeed OCPBUGS-4189 - Route CRD vs. OCP defaulting disparity OCPBUGS-4193 - [4.12] etcd failure: failed to make etcd client for endpoints [https://[2620:52:0:1eb:367x:5axx:xxx:xxx]:2379]: context deadline exceeded OCPBUGS-4195 - PTP 4.12 Regression - CLOCK REALTIME status is locked when physical interface is down OCPBUGS-4199 - route-controller-manager not creating routes in 4.12 OCPBUGS-421 - Disconnected IPI OCP 4.10.22 cluster install on baremetal fails when hostname of master nodes does not include the text "master OCPBUGS-4218 - highperformance irq balancing support causes the /etc/sysconfig/irqbalance to slowly grow unbounded OCPBUGS-4223 - Fix tuning plugin vlan handling OCPBUGS-4230 - CNCC: Wrong log format for Azure locking OCPBUGS-4234 - Updating ose-cloud-network-config-controller images to be consistent with ART OCPBUGS-4235 - Updating ose-cloud-network-config-controller images to be consistent with ART OCPBUGS-4250 - Backport PodNetworkConnectivityCheck for must-gather OCPBUGS-4251 - HyperShift control plane operators have wrong priorityClass OCPBUGS-426 - [OSP][OVN]unable to create logical router policy for egressIP after update duplicate IP to uniq one OCPBUGS-428 - Insights Operator should collect helm upgrade and uninstall metric OCPBUGS-4286 - [4.12] ovn-kubernetes ovnkube-master containers crashlooping after 4.11.0-0.okd-2022-10-15-073651 update OCPBUGS-4292 - Backport specify resources.requests for operator pod OCPBUGS-4299 - Backport Specify resources.requests for operator pod OCPBUGS-4303 - Backport Specify resources.requests for operator pod OCPBUGS-4308 - sanitize agent-gather output OCPBUGS-431 - Nutanix platform validations run at `create manifests` stage OCPBUGS-4311 - [4.12] Improve ironic logging configuration in metal3 OCPBUGS-4339 - oc get dc fails when AllRequestBodies audit-profile is set in apiserver OCPBUGS-4342 - The storage account for the CoreOS image is publicly accessible when deploying fully private cluster on Azure OCPBUGS-435 - Dropdown items on storageclass creation page need i18n support OCPBUGS-4356 - Reply packet for DNS conversation to service IP uses pod IP as source OCPBUGS-4361 - [release-4.12] bp ovnkube-trace changes to 4.12 OCPBUGS-4362 - Hard eviction thresholds is different with k8s default when PAO is enabled OCPBUGS-4365 - `oc-mirror` will hit error when use docker without namespace for OCI format mirror OCPBUGS-4366 - Update Kubernetes to 1.25.4 OCPBUGS-4369 - Update Cluster Sample Operator dependencies and libraries for OCP 4.13 OCPBUGS-4379 - apply retry logic to ovnk-node controllers OCPBUGS-4383 - Don't log in iterateRetryResources when there are no retry entries OCPBUGS-439 - DVO gatherer relies on the namespace name OCPBUGS-4397 - Route/v1 defaulting for target kind and termination must be sharable between openshift-apiserver and kube-apiserver OCPBUGS-4399 - Adding back SKIP_INTERFACES OCPBUGS-4407 - Update Cluster Sample Operator dependencies and libraries for OCP 4.13 OCPBUGS-4414 - [OCI feature] registries.conf support in oc mirror OCPBUGS-4421 - Dockerfile for building ironic-image for OKD does not take into account variant scos OCPBUGS-4422 - Implement LIST call chunking in openshift-sdn OCPBUGS-4431 - KubePodNotReady - Increase Tolerance During Master Node Restarts OCPBUGS-4453 - metal-ipi upgrade success rate dropped 30+% in last week OCPBUGS-4458 - Node Terminal tab results in error OCPBUGS-4478 - Backport: Guard Pod Hostnames Too Long and Truncated Down Into Collisions With Other Masters OCPBUGS-4479 - [4.12] Dockerfile for building ironic-image for OKD does not take into account variant scos OCPBUGS-4484 - `oc-mirror` will hit error when use docker without namespace for OCI format mirror OCPBUGS-4488 - Prometheus and Alertmanager incorrect ExternalURL configured OCPBUGS-4489 - Prometheus continuously restarts due to slow WAL replay OCPBUGS-4499 - CSR are generated with incorrect Subject Alternate Names OCPBUGS-4503 - [4.12] [OVNK] Add support for service session affinity timeout OCPBUGS-4504 - Default to floating automaticRestart for new GCP instances OCPBUGS-4505 - [4.12] Pod stuck in containerCreating state when the node on which it is running is Terminated OCPBUGS-451 - Show Git icon in repository link in details page should be based on the git provider OCPBUGS-4526 - hypershift: csi-snapshot-controller uses wrong kubeconfig OCPBUGS-4527 - hypershift: aws-ebs-csi-driver-operator uses wrong kubeconfig OCPBUGS-4533 - [release-4.12] OVNK: NAT issue for packets exceeding check_pkt_larger() for NodePort services that route to hostNetworked pods OCPBUGS-454 - [vsphere] update install-config description for diskType OCPBUGS-4544 - Remove debug level logging on openshift-config-operator OCPBUGS-4547 - CVE-2021-38561 ose-installer-container: golang: out-of-bounds read in golang.org/x/text/language leads to DoS [openshift-4] OCPBUGS-4554 - [4.12] OVN silently failing in case of a stuck pod OCPBUGS-456 - [4.12] update all ironic related packages to latest bugfix OCPBUGS-4599 - Bump samples operator k8s dep to 1.25.2 for 4.12 OCPBUGS-4601 - `oc-mirror` does not work as expected relative path for OCI format copy OCPBUGS-4627 - doc link in PrometheusDataPersistenceNotConfigured message is 4.8 OCPBUGS-4637 - Support RHOBS monitoring for HyperShift in CNO OCPBUGS-4649 - No indication of early installation failures OCPBUGS-4653 - [4.12] Fixes for RHCOS 9 based on RHEL 9.0 OCPBUGS-4660 - Debug log messages missing from output and Info messages malformed OCPBUGS-4667 - vsphere-hostname should check that /etc/hostname is not empty OCPBUGS-4681 - [release-4.12] remove unnecessary RBAC in KCM OCPBUGS-4686 - Removal of detection of host kubelet kubeconfig breaks IBM Cloud ROKS OCPBUGS-469 - OVN master trying to deleteLogicalPort for object which is already gone OCPBUGS-4696 - [4.12] SNO not able to bring up Provisioning resource in 4.11.17 OCPBUGS-4698 - Some nmstate validations are skipped when NM config is in agent-config.yaml OCPBUGS-4721 - GCP: missing me-west1 region OCPBUGS-4760 - [4.12] Network Policy executes duplicate transactions for every pod update OCPBUGS-4763 - Revert Catalog PSA decisions for 4.13 (Marketplace) OCPBUGS-4766 - limit cluster-policy-controller RBAC permissions OCPBUGS-4779 - Update openshift/builder release-4.12 to go1.19 OCPBUGS-478 - ironic-machine-os-downloader image is missing virt-* tools in OCP 4.12 nightlies OCPBUGS-4783 - [4.12] egressIP annotations not present on OpenShift on Openstack multiAZ installation OCPBUGS-4784 - [4.12] egressIP annotation including two interfaces when multiple networks OCPBUGS-4789 - [OCP 4.12] ironic container images have old packages OCPBUGS-4796 - OLM generates invalid component selector labels OCPBUGS-4803 - Update formatting with gofmt for go1.19 OCPBUGS-4805 - Empty/missing node-sizing SYSTEM_RESERVED_ES parameter can result in kubelet not starting OCPBUGS-4808 - Use shared library in admission to default Routes served via CRD OCPBUGS-4837 - [4.12] Pod LSP missing from PortGroup OCPBUGS-4840 - [4.12] The property TransferProtocolType is required for VirtualMedia.InsertMedia OCPBUGS-4847 - OnDelete update strategy create two replace machines when deleting a master machine OCPBUGS-4869 - AWS Deprovision Fails with unrecognized elastic load balancing resource type listener OCPBUGS-4884 - [4.12] Pods completed + deleted may leak OCPBUGS-4897 - Developer Topology always blanks with large contents when first rendering OCPBUGS-4911 - [Azure]Availability Set will be created when vmSize is invalid in a region which has zones OCPBUGS-4943 - Need to wait longer for VM to obtain IP from DHCP OCPBUGS-4951 - OLM K8s Dependencies should be at 1.25 OCPBUGS-4962 - openshift-install agent wait-for install-complete errors out before the cluster installation completes OCPBUGS-498 - Update console operator vendor with latest openshift/api OCPBUGS-499 - ClusterOperator Conditions Update on Reordering OCPBUGS-5019 - Fails to deprovision cluster when swift omits 'content-type' and there are empty containers OCPBUGS-505 - Input box aria-label and name wrong for editing PDB inside Deployments OCPBUGS-5067 - [4.12] coreos-installer output not available in the logs OCPBUGS-5072 - [4.12] ironic-proxy daemonset not deleted when provisioningNetwork is changed from Disabled to Managed/Unmanaged OCPBUGS-5100 - virtual media provisioning fails when iLO Ironic driver is used OCPBUGS-514 - [OCPonRHV] CSI provisioned disks are effectively preallocated due to go-ovirt-client setting Provisioned and Initial size of the disk to the same value OCPBUGS-5143 - provisioning on ilo4-virtualmedia BMC driver fails with error: "Creating vfat image failed: Unexpected error while running command" OCPBUGS-5156 - [release-4.12] Azure: unable to configure EgressIP if an ASG is set OCPBUGS-5185 - Dev Sandbox clusters uses clusterType OSD and there is no way to enforce DEVSANDBOX OCPBUGS-519 - publicIP is allowed in Azure disconnected installation for machines OCPBUGS-5190 - Installer - provisioning interface on master node not getting ipv4 dhcp ip address from bootstrap dhcp server on OCP IPI BareMetal install OCPBUGS-5191 - Add support for API version v1beta1 for knativeServing and knativeEventing OCPBUGS-523 - Plugin page error boundary message is not cleared after leaving page OCPBUGS-525 - Prerelease report bug link should be updated to JIRA instead of Bugzilla OCPBUGS-5253 - Missing 'ImageContentSourcePolicy' and 'CatalogSource' in the oci fbc feature implementation OCPBUGS-527 - Misleading error message when lacking assets to create the installation image OCPBUGS-5289 - Multus: Interface name contains an invalid character / [ocp 4.12] OCPBUGS-533 - member loses rights after some other user login OCPBUGS-5384 - Old AWS boot images vs. 4.12: unknown provider 'ec2' OCPBUGS-5387 - EUS upgrade: rpm-ostree clean up timeout was reached OCPBUGS-540 - Input values in Instantiate Template are disappeared randomly in the developer console OCPBUGS-5417 - Upgrade from 4.11 to 4.12 with Windows machine workers (Spot Instances) failing due to: hcnCreateEndpoint failed in Win32: The object already exists. OCPBUGS-5442 - Placeholder bug for OCP 4.12.0 microshift release OCPBUGS-5444 - Reported vSphere Connection status is misleading OCPBUGS-5455 - Baremetal host data is still sometimes required OCPBUGS-5474 - [4.12]Default CatalogSource aren't created in restricted mode OCPBUGS-548 - The application dropdown menu uses a custom component with a configuration to favorite applications, similar to the Project selection menu, but is inconsistent in the way it looks and behaves. OCPBUGS-561 - [4.12] Bootimage bump tracker OCPBUGS-569 - CVO History Pruner is non-functional, letting history length above MaxHistory OCPBUGS-575 - The lacking securityContext.seccompProfile.type of OLM deployments is blocking OCP upgrade to 4.12 OCPBUGS-576 - unbound router_id variable while creating event OCPBUGS-585 - Tuned overwriting IRQBALANCE_BANNED_CPUS OCPBUGS-595 - Kubelet cannot be started on worker nodes after upgrade to OCP 4.11 (RHCOS 8.6) when custom SELinux policies are applied OCPBUGS-613 - oc adm inspect --rotated-pod-logs not working properly for static pods OCPBUGS-617 - oc-mirror does not mirror arm64 OCP release payload OCPBUGS-643 - catsrc is not ready due to "compute digest: compute hash: write tar: open /tmp/cache/cache: permission denied" OCPBUGS-650 - "opm alpha render-veneer semver" raise error when no "Candidate" in config yaml OCPBUGS-651 - CBO gets confused by Terminating ports when a master fails OCPBUGS-670 - Prefer local dns does not work expectedly on OCPv4.12 OCPBUGS-675 - panic in etcdcli OCPBUGS-69 - No event log was emitted when egressIP exceeds capacity limit for cloud providers with SDN plugin OCPBUGS-690 - [2112237] [ Cluster storage Operator 4.x(10/11/12) ] DefaultStorageClassController report fake message "No default StorageClass for this platform" on Alicloud, IBM, Nutanix OCPBUGS-705 - vSphere privilege checking failing when providing user-defined folder and/or resource pool OCPBUGS-706 - [IBMCloud] e2e-ibmcloud-ipi-ibmcloud-gather-resources fails OCPBUGS-716 - EventsRecorder nonstandard / log only OCPBUGS-717 - Inquiries from customers regarding the EOL of Python 3.7. OCPBUGS-718 - Inefficient use of SG rules when creating Service LBs leads to scale issues OCPBUGS-722 - Undiagnosed panic detected in pod: openshift-controller-manager-operator_openshift-controller-manager-operator invalid memory address or nil pointer dereference OCPBUGS-729 - vsphere privilege check fails on vsphere6.7 u3 as missing privilege "InventoryService.Tagging.ObjectAttachable" OCPBUGS-745 - [4.12] Supermicro server FirmwareSchema CR does not contain allowable_values, attribute_type and read_only flag OCPBUGS-753 - dns-default pod missing "target.workload.openshift.io/management:" annotation OCPBUGS-766 - Missing the instance-type/region/zone labels in Machine CRs OCPBUGS-78 - Uninstalled operator can't be reinstalled if it included a conversion webhook OCPBUGS-785 - Bump documentationBaseURL to 4.12 OCPBUGS-800 - Name of workload get changed, when project and image stream gets changed on reloading the form on the edit deployment page of the workload OCPBUGS-819 - [ExtDNS] Invalid TXT records for wildcard domains on Azure OCPBUGS-825 - Available=False with no reason OCPBUGS-850 - Dockerfile: provide full URL to CentOS stream image OCPBUGS-852 - oc debug requires a user to create a namespace with specific security labels OCPBUGS-853 - openshift-ingress-operator is failing to update router-certs because "Too long: must have at most 1048576 bytes" message OCPBUGS-858 - package-server-manager does not migrate packageserver CSV from v0.17.0 to v0.18.3 on OCP 4.8 -> 4.9 upgrade OCPBUGS-861 - Rebase openshift/etcd 4.12 onto v3.5.5 OCPBUGS-864 - ClusterOperator Conditions Update on Reordering OCPBUGS-867 - package-server-manager does not stomp on changes made to packgeserver CSV OCPBUGS-869 - Change 'OpenShift Managed (Azure)' to 'Azure Red Hat OpenShift' for Azure support case link OCPBUGS-872 - provisioning interface on master node not getting ipv4 dhcp ip address from bootstrap dhcp server on OCP IPI BareMetal install OCPBUGS-884 - Update RHCOS release browser url OCPBUGS-889 - 4.12 installer is pointing at stable-4.11 channel OCPBUGS-917 - create egressqos with wrong syntax/value rules success OCPBUGS-926 - [vsphere-problem-detector] report privilege missing when using pre-existing folder and/or resource pool with ReadOnly permission OCPBUGS-927 - Azure install fails in CI: Error: error creating/updating Private DNS Zone Virtual network link OCPBUGS-929 - The help message of "opm alpha render-graph" is not correct OCPBUGS-939 - Flaky CI: Object.verifyTopologyPage timeout after importing a Devfile OCPBUGS-943 - Could not import Devfile after testing a non-Devfile version OCPBUGS-944 - CI failure due to pod security in manila OCPBUGS-946 - Warnings in storage cluster operator PowerVS CSI driver deployment OCPBUGS-954 - [2087981] PowerOnVM_Task is deprecated use PowerOnMultiVM_Task for DRS ClusterRecommendation OCPBUGS-959 - Born in 4.1 and 4.2 clusters have 'openshift.io/run-level: 1' uncleared OCPBUGS-963 - [OCPonOpenstack] Remove clustername length limitation OCPBUGS-967 - Panic in test: [sig-network] IngressClass [Feature:Ingress] should prevent Ingress creation if more than 1 IngressClass marked as default [Serial] [Suite:openshift/conformance/serial] OCPBUGS-977 - SR-IOV MutiNetworkPolicy: Rules are not removed after disabling multinetworkpolicy OCPBUGS-978 - leases not gracefully released in OCM OCPBUGS-985 - Metal serial tests are failing on webhook admission about provisioningDHCPRange OCPBUGS-987 - Whereabouts should allow non default interfaces to Pod IP list OCPBUGS-990 - HyperShift 4.12 jobs fail to install csi-snapshot-controller-operator OCPBUGS-999 - aws driver toolkit jobs are permafailing 6. References: https://access.redhat.com/security/cve/CVE-2021-4235 https://access.redhat.com/security/cve/CVE-2021-22570 https://access.redhat.com/security/cve/CVE-2021-38561 https://access.redhat.com/security/cve/CVE-2022-1705 https://access.redhat.com/security/cve/CVE-2022-2879 https://access.redhat.com/security/cve/CVE-2022-2880 https://access.redhat.com/security/cve/CVE-2022-2995 https://access.redhat.com/security/cve/CVE-2022-3162 https://access.redhat.com/security/cve/CVE-2022-3172 https://access.redhat.com/security/cve/CVE-2022-3259 https://access.redhat.com/security/cve/CVE-2022-3466 https://access.redhat.com/security/cve/CVE-2022-21698 https://access.redhat.com/security/cve/CVE-2022-24302 https://access.redhat.com/security/cve/CVE-2022-27664 https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/cve/CVE-2022-32148 https://access.redhat.com/security/cve/CVE-2022-32189 https://access.redhat.com/security/cve/CVE-2022-32190 https://access.redhat.com/security/cve/CVE-2022-41316 https://access.redhat.com/security/cve/CVE-2022-41715 https://access.redhat.com/security/cve/CVE-2022-42010 https://access.redhat.com/security/cve/CVE-2022-42011 https://access.redhat.com/security/cve/CVE-2022-42012 https://access.redhat.com/security/cve/CVE-2022-42898 https://access.redhat.com/security/cve/CVE-2023-0296 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY8cih9zjgjWX9erEAQiIYQ//X7Lt5e0g8KIXbD6sX0PYCogFU5JFv+Jb JFhm235UL7vKT3tiwFMpGCW32SGmEa/qMfyvKtSoIrN847JHYQWFz1fOAqKC1fxs OqE99PPhjKeJ0a10OXtcQPaQwkXJIYxVpbInHdVjdPh88FtYVgIgR8zUjlcrMFIh tJLW6A7c26i/Njc2I2I/edPbb39jeygc4ZJIqekGgaQbu15dyIEa8GKGQ66Hy7tp r48TT7bXRsOdaxeiz7tFpVZDRdA4k3ktXveBPo1TKA8TG78ior1jIBdoS6DHniyC EAl09ilLgKa3rkuoLtmp6PIe5b95m0xgfUtanJSBK9sI3+yzlz3ITRkVKbSfXRnd CFfb5lJB8ul2p9/f+ZAFc29HQdNS8ohU/NZ/7Ij34d5Xvh0pob62yg8LF444ZOGZ KpP1T6o1JbW2IsVFO9kmAztDAk94VqKLD608EsnC1P3VWEBF9qBenCTITlqQM/Oa H9LUNUGj0A2LS7j0GK0344bII0W65MKfcPIQ+SCyOTgVfxzlDspQEVhR1HoepxuG eUcicIFWYcaJ7jUTdHcLfwewiCr8hdx2v1F/6UQmuBpgA5bNJkGvjRgh1YwGUcJU VrGt6Nl647UKLzwCbLxDjQSDbwr+K+kJhqCd+umNz5iPuRYurcDemALy+HLy9Gid 1ZZ25YS8Xvk= =oXLl -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce