OpenShift Container Platform 4.4 release notes

The olm-catalog gen-csv subcommand is now moved to the generate csv subcommand.

The up local subcommand is now moved to the run --local subcommand.

GA: General Availability

DEP: Deprecated

-: Removed

Previously, if a user attempted to log in from the CLI when only browser-based login was configured, they were prompted for a user name and password. Now, if a user attempts to log in from the CLI when only browser-based login is configured, a message is shown that instructs users how to retrieve the login token. (BZ#1671604)

Previously, due to a race condition, it went unnoticed when the mounted serving certificate changed or appeared, so the serving certificate was not trusted by metrics scrapers on the HTTPS endpoint. The race condition was removed and Operators based on library-go are now able to reload the serving certificate correctly. (BZ#1779438)

Previously, the Kubernetes API server service network address was not handled properly if an IPv6 address was used. The OAuth proxy can now properly connect to the Kubernetes API server if it serves on an IPv6 address. (BZ#1789462)

Before starting a build, the OpenShift Container Platform builder would parse the supplied Dockerfile and reconstruct a modified version of it to use for the build, to add labels and handle substitutions of the images named in FROM instructions. The generated Dockerfile did not always correctly reconstruct ENV and LABEL instructions. The generated Dockerfile would sometimes include = characters where the original did not, and the build would fail with a syntax error. With this bug fix, when generating the modified Dockerfile, the original text for ENV and LABEL instructions is now used verbatim. As a result, the build process no longer introduces syntax errors in ENV and LABEL instructions. (BZ#1821860)

The JenkinsPipeline build strategy is deprecated as of OpenShift Container Platform 4.3.0. Use Jenkinsfile object directly on Jenkins or OpenShift Pipelines instead. (BZ#1804976)

Build label generation and validation was not fully conforming to Kubernetes expectations. Builds could fail with certain BuildConfig object names with invalid label errors. This bug fix updates the build controller and build API server to now use complete Kubernetes validation routines to ensure any added build labels will meet Kubernetes label criteria. As a result, builds with any valid BuildConfig object name will not fail because of invalid build label values. (BZ#1804934)

Previously, if the Samples Operator’s samplesRegistry field was changed and it still led to an image stream import error, it appeared that the Samples Operator did not take the configuration change when viewing the image stream status. Now, if a change to the Samples Operator’s samplesRegistry field still leads to an image stream import error, the new failure reasons now properly appear in the image stream status. (BZ#1795705)

Previously, after a RUN instruction, the OpenShift Container Platform builder attempted to unmount each of the bind mounts that were created, and logged any errors that were encountered in the process. The builder now only unmounts the top-level directory, and has the kernel unmount the bind mounts. The errors are no longer encountered and therefore no longer reported. (BZ#1772179)

Previously, setting both incremental and forcePull flags to true on a build strategy could result in builds using push image credentials to pull images. As a result, image pulls from private registries would fail. Now, the build image properly manages registry push and pull credentials when both incremental and forcePull are set to true. (BZ#1774492)

The command oc new-build did not have the same --insecure-registries flag available with the oc new-app command to allow for the sure of insecure image reference URLs as their source. As a result, oc new-build invocations would receive errors when attempting to make HTTPS connections using HTTP-based image references were supplied as the base image for the build. Now, The --insecure-registries option has been added to the oc new-build command and users can now create builds that reference insecure registries as their base image. (BZ#1780714)

The Cloud Credential Operator (CCO) would report on CredentialsRequest CRs with conditions even when the CCO has been disabled. Alerts would show even when the Operator has been configured to be disabled. With this bug fix, conditions are no longer reported when the CCO is set to disabled. (BZ#1794536)

Reconciling a CredentialsRequest CR would attempt to create a role assignment that already exists, and Microsoft Azure logs would show create role assignment errors. This bug fix checks for existing role assignments to avoid creating one that already exists. As a result, there are less error messages in Azure logs. (BZ#1776079)

When selecting a VM template without annotations, the VM wizard closed unexpectedly. The VM wizard now works with templates that do not have any annotations. (BZ#1776190)

Previously, when creating a VM template that uses a URL as a disk image source, a persistent volume claim (PVC) was not created for VMs created when using the template. Now when creating a new VM from such a template, the PVC is cloned and used for the disk image. (BZ#1779116)

Previously, different units were used when interpreting values for memory and storage in a template, causing requests to create a VM to fail on some occasions. The value for memory and storage in a VM template now use Gi units consistently. (BZ#1792101)

Previously, the VM wizard ignored any disk configuration in a VM template. The VM wizard now uses the disk configuration if specified in a template. (BZ#1782434)

The UI previously reported that failed VM migrations had succeeded. When migrating a VM, the UI now correctly reports when a VM migration fails. (BZ#1785344)

Previously, if a VM had multiple CD-ROM drives defined, it was not possible to remove each CD-ROM drive without saving, and then reopening the dialog for each CD-ROM. Now multiple CD-ROM drives can be removed without saving and reopening the dialog. (BZ#1786070)

Previously, it was not possible to create a VM with the default YAML used by the VM wizard because the YAML was invalid. It is now possible to use the default VM template when creating a VM with the wizard. (BZ#1808304)

Previously, it was not possible to modify the boot order by using the visual editor because the boot order in the template YAML was unrecognized. It is now possible to modify the boot order when using the visual editor. (BZ#1789269)

The oc tag command did not update image streams when ImageStreamTag objects are inaccessible. The command would report that the new tag was created, but it was not. This bug fix updates the oc tag command so that it actually creates the tag even if there are no permissions for the ImageStreamTag API. (BZ#1746149)

To detect whether base64 was padded or unpadded, the decoder was relying on the string length. This made the decoder unable to handle pull secrets that contain whitespaces. This bug fix checks if the string has trailing padding symbols instead. As a result, pull secrets with whitespaces can be used to pull images. (BZ#1776599)

Previously, the Image Registry Operator did not report a new version if it was in the unmanaged state, which blocked upgrades. With this bug fix the Image Registry Operator now reports the accurate version when it is the unmanaged state, which results in successful upgrades. (BZ#1791934)

Previously, the nodeca daemon set did not tolerate NoSchedule taints, which caused missing pods on nodes. This bug fix adds toleration so tainted nodes receive updates from the nodeca daemon set. (BZ#1785115

The Image Registry Operator was using a rolling update strategy that was not compatible with RWO volumes, which meant that RWO volumes could not be used. This bug fix allows the Image Registry Operator to pick up the rolling update strategy, and can now be deployed with RWO volumes in non-high-available configurations (i.e., configurations with only one replica). (BZ#1798759)

Previously, the Image Registry Operator did not clean up the storage status when it was removing storage. When the registry was switched back to the Managed state, it was not able to detect that storage needed to be bootstrapped. With this bug fix the Image Registry Operator cleans up the storage status, allowing the Operator to create storage when it is switched back to the Managed state. (BZ#1787488)

Earlier versions of clusters that you provisioned on AWS with installer-provisioned infrastructure do not include security group rules that allow traffic from control plane hosts to workers on TCP and UDP ports 30000-32767. Because of this, new OVN Networking components cannot work as intended. Now, the required security group rules will be added to these clusters to allow communication between control plane and worker machines on TCP and UDP ports 30000-32767, and OVN Networking components work as intended. (BZ#1763936)

Previously, the upgrade process on Red Hat Enterprise Linux (RHEL) nodes was blocked. An unnecessary machine config apply step failed when it could not pull images from behind the proxy. The unnecessary step was removed, and upgrades to RHEL nodes behind a proxy can succeed. (BZ#1786297)

Previously, when you upgraded RHEL 7 nodes from version 4.2.12, the machine config was not properly updated by the MCO. Because package installs updated files on the local disk, the MCO did not process config updates on RHEL nodes. Now, the machine config apply step has been restored, and the image pull process can complete behind a proxy. Machine configs are correctly applied after package updates, and upgrades on RHEL 7 nodes succeed. (BZ#1792139)

Although metrics for metrics for aggregated API server status existed, alerts for them did not. Now, an error displays when an aggregated API reports too many errors in a short period of time because that indicates that the availability of the services changes too often. (BZ#1772564)

Previously, certificates were not propagated correctly, so the cloud provider was unable to initialize behind a man-in-the-middle proxy. Now, the certificates are correctly propagated to the kube-controller-manager, and the cloud provider works as expected with a man-in-the-middle proxy. (BZ#1772756)

Previously, you could use Fluentd plug-ins to forward logs to external systems using syslog protocol (RFC 3164). The Log Forwarding API added to OpenShift Container Platform 4.3 changed the process for configuring log forwarding using syslog. As a result, you could not forward logs using the same method as in OpenShift Container Platform 4.2. To address this change, a new process was devised to allow log forwarding using the syslog protocol. This change was backported to OpenShift Container Platform 4.3.7. As a result, you can continue to forward logs to an external syslog server. (BZ#1799024)

Because some applications, such as Kuryr, are sensitive to HAProxy timeout values, 24-hour timeout values were used for the API LB. If an HAProxy reload operation was triggered many times in a short period, it was possible for many HAProxy processes to accumulate. This bug fix forces sending SIGTERM after a default timeout of 120 seconds to old HAProxy processes which have not yet terminated. As a result, the number of long lived duplicate HAProxy processes is reduced. (BZ#1771566)

Metering does not manage or delete any S3 bucket data. When deleting a report, any S3 buckets used to store metering data must be manually cleaned up. If reporting data stored in an S3 bucket is not manually cleaned up and the same report is re-created, the original reporting data will still exist and will cause duplicate row entries. (BZ#1728350)

Because the OAuth proxy container readiness probe was misconfigured, the container logs were flooded by error messages every 10 seconds. The readiness probe has been configured with the proper settings. As a result, the error messages are not appearing in the logs. (BZ#1658899)

Because the cluster-reader role does not have the permission to view node or pod metrics, users bound to that role could not access metrics using commands such as oc top node. The cluster-reader role has been updated to include permissions to allow viewing metrics. (BZ#1723662)

A new experimental Prometheus user interface was introduced upstream. The new experimental interface that was not fully tested and not stable. As a result, switching from the experimental interface to the default interface returned an empty page. To prevent this issue, the link to the experimental UI has been hidden. As a result, it is no longer possible to access the experimental Prometheus interface. (BZ#1781415)

OpenShift Container Platform was evaluating some recording rules incorrectly, As a result, the metrics generated from the recording rules are missing. The recording rules have been fixed. All recording rules now evaluate successfully. (BZ#1807843, BZ#1779324)

A previous Egress IP bug fix did not fully clean up after removed Egress IPs resulting in the possibility that harmless extra iptables rules could be left behind on a node. With this bug fix, the extra rules are now removed if they are no longer being used. (BZ#1787488)

Previously, using the httpProxy or httpsProxy hostname with uppercase letters makes the CNO fatal, which is a violation of RFC 3986. As a result, CNO was not operational. This bug fix parses it with the golang url.ParseRequestURI, which implemented RFC 3986 correctly and a few more RFCs. As a result, capital case is now allowed in httpProxy and httpsProxy. (BZ#1802606)

Previously, the Kube config used by the kubelet, which is used on the SDN, changed its path causing SDN to have a null deference trying to parse the empty file. This bug fix made SDN able to handle both old and new paths. (BZ#1781707)

Previously, no alerts were issued when kubelet certificates expired. This caused kubelets to stop working without administrators realizing it. This fix adds a server_expiration_renew_errors metric to report expired certificates. (BZ#1767523)

Conmon was timing out on kubelet exec liveness probes. This caused some exec probes to fail, forcing the container to be killed and restarted. The exec liveness probes now work as expected. (BZ#1817568)

On node reboot, CRI-O was not cleaning up IP addresses correctly when pods could not be restored. This led to node IP exhaustion, causing pods to not start. Now if a pod cannot be restored after restart, the pod network is destroyed, releasing the IP addresses for future use. (BZ#1781824)

RHEL 7 could not be added to an OpenShift Container Platform cluster because CRI-O would not start. This was caused by a Conmon package issue. This release fixes Conmon and RHEL 7 can now join an OpenShift Container Platform cluster. (BZ#1809906)

The horizontal pod autoscaler (HPA) was not receiving metrics from exited init containers. This is fixed by submitting zero-based metrics for exited init containers, allowing the HPA to perform analysis on pods with an init container. (BZ#1814283)

The kubelet metrics endpoint was periodically returning a 500 status code, which prevented Prometheus from gathering metrics for the kubelet endpoint and node. The 500 code was caused by dead containers mixing into the metrics stream, causing duplicate metrics to be injected. This bug is fixed and metrics are now correctly reported from the kubelet. (BZ#1748073)

The oc logs command was returning errors for some resources due to OpenShift CLI’s internal code not accounting for new versions of APIs. OpenShift CLI now supports all known API types and versions, allowing oc logs to work for all resources. (BZ#1774366)

When running the oc adm node-logs command with the --since argument, an error occurred. This was caused by a typo in the expected timestamp format. The typo has been corrected and the oc adm node-logs now works with the --since argument. (BZ#1779563)

Previously, Helm 3.0.0+ did not work with OpenShift Container Platform objects. This resulted in an error when trying to deploy valid Helm charts. With this update it is now possible to deploy Helm charts with OpenShift Container Platform objects. (BZ#1773682)

Previously, openshift-controller-manager metrics were not properly registered with the 1.16 Kubernetes Prometheus registry. This caused missing metrics for the OpenShift Container Platform control plane. With this update the openshift-controller-manager metrics are now properly registered and the missing OpenShift Container Platform control plane metrics have been restored. (BZ#1810304)

Previously, pull secrets were sometimes not deleted when their associated token was deleted. This caused pull secrets to remain associated with Kubernetes service accounts. With this update references to the owner of a pull secret and the associated token secret have been established. Now, when a pull secret is deleted the associated token is deleted as well. (BZ#1806792)

Previously, the rate limit for creating pull secrets in the internal registry was low. This caused long wait times when a large number of namespaces were created in a short time period. With this update the rate limit for creating pull secrets in the internal registry has been increased. Pull secrets can now be created quickly even during heavy load. (BZ#1819849)

Network teaming is now supported in Red Hat Enterprise Linux CoreOS (RHCOS). The teamd and NetworkManager-team RPMs have been added to RHCOS, enabling the setup and management of teamed network devices. (BZ#1758162)

IPv6 was not supported by registry.redhat.io, which meant that the Samples Operator was not supposed to attempt to install image streams, as all Red Hat samples are hosted on registry.redhat.io. Because IPv6 is a key initiative for Red Hat and for OpenShift Container Platform, the Samples Operator will no longer break OpenShift Container Platform installs on IPv6. (BZ#1788676)

The Samples Operator was previously failing to report its version when running on s390x or ppc64le, so installs on those architectures would not complete successfully. With this fix, the Samples Operator now reports its version correctly and no longer prevents installs on s390x or ppc64le. (BZ#1779933)

Previously, the latest Java 11 image stream tag did not correctly link to the version on the image stream details page, which meant that that ImageStreamTag object could not be inspected from the web console. With this fix, the correct ImageStreamTag specification for Java 11 can now be properly inspected from the web console. (BZ#1778613)

Previously, local reference settings on image streams could be ignored if the image stream was accessed by controller manager shortly after startup but before the image stream metadata was updated. This resulted in failed requests to image streams backed by private registries. With this update the controller manager refreshes its image stream cache after metadata initialization is complete. This results in accurate local reference image stream policies even immediately after startup. (BZ#1775973)

Pods could not be scheduled and PVCs remained pending if the storage-class annotation was used instead of storageClassName for the Local Storage Operator. With this fix, the Kubernetes scheduler now checks both volume.beta.kubernetes.io/storage-class and the PVC.Spec.StorageClassName when evaluating a pod and its PVCs. Pods that use the beta annotation to refer to a StorageClass can now be scheduled and will now run. (BZ#1791786)

Previously, Kubernetes did not unmount a CSI volume when a pod was deleted while the volume mount timed out before eventually being completed by the CSI driver. This caused a volume to be mounted on a node without Kubernetes knowing about it. As a result, the volume could not be mounted anywhere else. With this fix, Kubernetes waits for a final success or error after the CSI driver returns a timeout or other similar transient error. Now, Kubernetes knows if a volume was mounted or unmounted and cleans up possible stray mounts when a pod is deleted. (BZ#1745776)

When using the --param-file option with template processing commands like oc new-app or oc process, if the file was greater than 64K in size, it would not be fully read in. This caused the the oc-based template processing with --param-file to fail. OpenShift Container Platform now checks the size of the file specified by --process-file and augments the parameters used to read the entire file. The oc-based template processing with --param-file pointing to files greater than 64K now works. (BZ#1748061)

Previously, one of the new-app/new-build examples used for project creation would cause an error in a FIPS environment because the example was not FIPS-compliant. Now, only FIPS-compliant new-app/new-build examples are shown on new project creation and users can use any of the examples in a FIPS environment. (BZ#1774318)

Previously, the Rebuild action on the OpenShift Console build page was incorrectly disabled for users who were did not have cluster-admin privileges. Now, this issue has been resolved and the action is now correctly enabled for normal users who should have permission to clone builds. (BZ#1774842)

Previously, only cluster administrators could see example YAML templates created using the ConsoleYAMLSample resource in console YAML editor. Now, all users can see these templates. (BZ#1783163)

On the cron jobs list page, sorting by Starting Deadlines Seconds or Concurrency Policy fields were not sorted correctly. Now, the sortField has been updated and you can now sort cron jobs correctly. (BZ#1787096)

The Local Volumes page would display duplicate content due to conditions that created content duplication. Now, the conditions are removed from the status descriptors and content is not duplicated. (BZ#1776131)

The Role Bindings page had a non-clickable Create Binding button for users who did not have any projects. Now, the Create Binding button is hidden for users who do not have any projects. (BZ#1785487)

Previously, some required fields that have OLM descriptors were missing the required red asterisk in the web console Create Operand form. Now, all of the required fields are correctly labeled. (BZ#1779858)

Previously, you could set a negative value for the machine or replica count values in the web console. Now, you cannot set a value that is less than 0. (BZ#1780367)

Previously, the PodRing GUI component did not reflect the correct pod count when the count was updated on the Deployment Config Page and then updated again on the same page by clicking Actions then Edit Count. For example, if the pod count was increased from 5 to 10 pods by using Edit Count on the Deployment Config Page and the user then increased the count on the PodRing component by using the up arrow, the PodRing counter incorrectly increased from 5 to 6 pods instead of from 10 to 11. With this update, when a change is made using Edit Count on the Deployment Config Page, the PodRing component now shows the correct, updated pod count. Additionally, when the user clicks the up or down arrow on the PodRing component, the pod count accurately updates. (BZ#1787210)

Previously, a user could not edit a cluster-scoped operand on the Installed Operators page in the web console. Instead, an HTTP 404 Not Found client error response code occurred in the web browser for the operand YAML editor. With this update, the web console correctly opens a new web browser for the operand YAML editor, in which a user can update a cluster-scoped operand. (BZ#1781246)

Previously, the web console did not replace all instances of a variable when it occurred multiple times in a ConsoleExternalLogLink URL template. Instead, only the first expression of the variable was replaced. With this update, the console correctly replaces every instance of the variable in the template with the correct value. (BZ#1781827)

Previously on the Operator Details page in the web console, the link to the InstallPlan resource from the Subscription Overview was broken. This made it difficult for users to approve InstallPlan resources in the web console. The link to approve InstallPlan resources (for example, a link showing output that 1 requires approval) now works as expected. (BZ#1783651)

Previously, an error occurred when a user filtered by source name in the Source tab on the OperatorHub Details page in the web console. The filter has been fixed and now works as expected when a user inputs a source name. (BZ#1786418)

Previously, API documentation was missing for the Endpoints resource on the Explore page in the web console. API documentation, such as descriptions and schema information, is now available for the Endpoints resource. (BZ#1794754)

Previously, the web console failed to show an operand if an invalid OLM descriptor was set by an Operator. As a result, an error occurred on the expected web console page. With this update, invalid OLM descriptors are tolerated and the console correctly displays the operand details. (BZ#1797727)

Previously, some status values did not have an icon associated with them. As a result, some values appeared with an icon and others did not. Icons are now defined for and will appear with all values. (BZ#1780629)

Previously, the console did not check for special characters in routing labels, which could result in the following error:

AlertmanagerFailedReload Alert:
Reloading Alertmanager's configuration has failed for openshift-monitoring/alertmanager-main-x.

Previously, the web console would show a blank page if an Operator declared an invalid K8sResourceLink OLM descriptor. The console now tolerates incorrect K8sResourceLink descriptors, which prevents the appearance of blank pages. (BZ#1795407)

Previously, modifying required Operator resources from the web UI would not update those Operators' YAML files. The YAML files now update as expected. (BZ#1797769)

Previously, alerts remained in the notifications drawer after they were silenced. Silenced alerts no longer remain in the notifications drawer. (BZ#1808062)

A bug in web console builds occasionally resulted in runtime errors on certain pages. The bug was fixed. (BZ#1818978)

The query browser results in the web console are rendered with a hard-coded sort, rendering a different result than might be intended with a custom sort. The hard-coded sort has been removed, allowing for the query results to reflect any custom sort. (BZ#1808437)

Creating a new MachineConfigPool using the console’s Compute → Machine Config Pools → Create Machine Config Pool button results in a MachineConfigPool that does not match the node. This is caused by the template using the spec.machineSelector key for selecting the nodes to match. However, this key is not recognized by the API; the correct one for selecting a node is spec.nodeSelector. The key for selecting nodes has been updated, allowing the GUI to display a Machine Selector which now matches the appropriate node. (BZ#1818944)

Previously, the web console pod terminal did not correctly handle Unicode characters. This problem has been fixed, and Unicode characters now display correctly. (BZ#1821285)

Previously, the volumes table on the web console workload pages could partially disappear when scrolling the page. This bug has been fixed. (BZ#1822195)

Previously, the default templates used to create reports and report queries were using apiVersion v1alpha instead of v1. Although the alpha versioned templates still worked, their case support could be dropped at any time. The templates have been updated to use apiVersion: metering.openshift.io/v1. (BZ#1772694)

When clicking the web console’s Dashboard and selecting a navigation item within the Dashboard, both navigation items that were selected remain highlighted. This bug fix applies new CSS rules to eliminate multiple navigation items from being highlighted at the same time, ensuring only the active navigation item is highlighted. (BZ#1774702)

The Microsoft Edge browser did not recognize the functionality used for scrolling. The Log screen was unable to load and would result in an error. Screen reader support was enabled and the logs now render. (BZ#1777980)

Serverless resources like the Service YAML file are listed as v1beta1 instead of v1. However, v1beta1 is deprecated. With this bug fix, the apiVersion is updated to v1. (BZ#1796421)

A service binding request (SBR) in the topology is associated with Revisions in the Topology view. Therefore, no new revision will get the associated secrets. The SBR should go through the Knative service; secrets would be injected and new revisions would be created. (BZ#1798288

The API group of KnativeServing resources serving.knative.dev is deprecated and it has changed to operator.knative.dev in the Serverless Operator version 1.4. In the next release of the Serverless Operator, serving.knative.dev will be obsolete. (BZ#1800598

In container image deployment, if an internal image stream is selected for Knative, then Knative tries to create a new image stream, which might fail. You are unable to deploy the internal image stream as a Knative service. Do not create a new image stream for internal image selection; it already exists. (BZ#1808280

In a Kubernetes deployment, if the images from the external image registry had tags such as openshift/hello-world:1.0, then the tags were not being applied. The user was unable to import external images with tags. With this bug fix, the proper tag for the deployment is now passed. (BZ#1801736

Previously, when two consecutive rollouts failed, the Topology view showed failed pods instead of displaying the last active revision. With this bug fix, when a rollout fails, the last active revision is displayed. (BZ#1760828)

Previously, existing image streams in a namespace were not detected when creating an application. This occurred when users with limited cluster-wide permissions used the Container Image → Image name from the internal registry options in the Add page. Now, the image stream fetching logic has been moved from the cluster level to the namespace level, which enables a user with permission to a namespace to see image streams in that namespace. (BZ#1784264)

Knative service and revision resources did not have binding or visual connectors in the Topology view and therefore Knative workloads could not connect to other workloads. These resources now have connectors in the Topology view and can connect to other workloads. (BZ#1779201)

When the eclipse Che Operator was installed and configured, the Topology view showed the Git icon instead of the Che icon. This provided no indication to the user that they could click the icon to access the Che workspace. The Topology view now correctly displays the Che icon when Che is configured, making it easier for the user to access the Che workspace. (BZ#1780338)

Creating a Knative service using the CLI while the Topology view was open caused a GUI error. Checks have been added to handle this workload without causing a GUI error. (BZ#1781188)

The internal registry feature had an unclear error message when there was a server-side error. Improved error messaging helps the user identify the cause of the problem. (BZ#1787492)

TP: Technology Preview

GA: General Availability

-: Not Available

There is an issue with the Machine Config Operator (MCO) supporting Day 2 proxy support, which describes when an existing non-proxied cluster is reconfigured to use a proxy. The MCO should apply newly configured proxy CA certificates in a config map to the RHCOS trust bundle; this is not working. As a workaround, you must manually add the proxy CA certificate to your trust bundle and then update the trust bundle:

$ cp /opt/registry/certs/<my_root_ca>.crt /etc/pki/ca-trust/source/anchors/
$ update-ca-trust extract
$ oc adm drain <node>
$ systemctl reboot

When using a self-signed Red Hat OpenStack Platform (RHOSP) 16 cluster, you cannot pull from or push to an internal image registry. As a workaround, you must set spec.disableRedirect to true in the configs.imageregistry/cluster resource. This allows the client to pull the image layers from the image registry rather than from links directly from Swift. (BZ#1810461)

The cluster proxy configuration HTTP_PROXY is only available for OpenShift Container Platform components, not user applications. As a workaround, you must run the following command to enable cluster proxy configuration for user applications:

$ oc set env dc/jenkins \
    http_proxy=$(oc get proxy cluster -o jsonpath='{.status.httpProxy}') \
    https_proxy=$(oc get proxy cluster -o jsonpath='{.status.httpsProxy}') \
    no_proxy=$(oc get proxy cluster -o jsonpath='{.status.noProxy}')

All git clone operations that go through an HTTPS proxy fail. HTTP proxies can be used successfully. (BZ#1750650)

All git clone operations fail in builds running behind a proxy if the source URIs use the git:// or ssh:// scheme. (BZ#1751738)

When using a mirror to build images, the build fails when the pull secret for the mirror registry only links to the builder service account. The pull secret must also link to the build config object. (BZ#1810904)

In Red Hat OpenStack Platform (RHOSP) 13 with Kuryr, if FIPS is disabled, you cannot enable Service Catalog. Pods for Service Catalog’s controller manager and API server components show a status of CrashLoopBackOff. This is due to the https://etcd.openshift-etcd.svc.cluster.local:2379 URL not always resolving. There is a new technique for getting the etcd cluster URL in OpenShift Container Platform 4. (BZ#1821589)

Installing RHOSP 16 with Kuryr does not work due to the ovn_controller crashing after initial setup. (BZ#1812009, BZ#1818844)

The Red Hat Virtualization (RHV) machine instance-state annotation and the providerStatus.instanceState status do not always match. This mismatch causes the client to fail or incorrectly patch the RHV machine status. (BZ#1815394)

When scaling up a machine set on RHV, the new machine cannot exit the Provisioned phase. This causes the machine to never run. (BZ#1815435, BZ#1817853)

OpenShift Container Platform cluster autoscaling on RHV fails due to cluster resource computation errors. (BZ#1822118)

When using the Firefox browser to select a node or a group of nodes in the Topology view, the backgrounds of all the associated labels and nodes become transparent. (BZ#1822337)

In the Topology view, when a user selects a node or workload, and then clicks Monitoring → View monitoring dashboard on the side panel, the user sees the monitoring dashboard for that specific workload. This filtered workload dashboard view is not clearly named, which causes confusion with the generic dashboard that displays metrics for all the workloads. (BZ#1822331)

When invalid characters such as a period (.) are entered in the serverless traffic distribution tag from the Developer perspective, the traffic distribution feature stops working. However, it displays no error messages to prevent invalid characters from being entered in the tag. (BZ#1822344)

If an identity provider (IDP) takes longer than 60 seconds to authenticate a user, the authentication might fail before trying other IDPs. As a workaround, you can remove the faulty IDP from the list of IDPs so that users can use a successful IDP to authenticate. (BZ#1826484)

When updating cluster logging from version 4.3 to 4.4, the Elasticsearch pods might get stuck in the CrashLoopBackOff status. You can work around this issue by deleting the Elasticsearch deployments in sequence. (BZ#1824006)

OpenShift Container Platform 4.4 is not shipping with a v.4.4 Metering Operator. Customers can install or continue to run the v.4.3 Metering Operator on OpenShift Container Platform 4.4 clusters. (BZ#1829035)

When updating an OpenShift Container Platform cluster from version 4.3 to 4.4, the etcd Operator sometimes fails to upgrade because it is in a degraded state. This is caused by an InstallerPod failure. As a workaround, you must force a new revision on etcd to overcome the InstallerPod failure, which allows the etcd Operator to recover:

The web console downloads deployment will fail on nodes configured with ipv6.disable=1. (BZ1795325)

An issue in Topology Manager could result in NUMA resources not being aligned to the same NUMA node if guaranteed QoS pods are created simultaneously on the same node. As a result, the resources requested in the pod spec might not be NUMA aligned.

VMs with the runStrategy attribute set to Manual do not indicate whether they are running or stopped, and the web console incorrectly assumes they are running. To avoid this issue, do not set runStrategy to Manual when working with VMs in the web console. Instead, use the running attribute or set runStrategy to Always, RerunOnFailure, or Halted. (BZ#1834717)

When upgrading to a new OpenShift Container Platform z-stream release, connectivity to the API server might be interrupted as nodes are upgraded, causing API requests to fail. (BZ#1791162)

When upgrading to a new OpenShift Container Platform z-stream release, connectivity to routers might be interrupted as router pods are updated. For the duration of the upgrade, some applications might not be consistently reachable. (BZ#1809665)

Due to an issue related to expiring OAuth tokens, you might receive a security_exception error in the Kibana console and not be able to access your Kibana indices. If you see this error, log out of the Kibana console then log back in. This will refresh your OAuth tokens and you should be able to access your indices. (BZ#1791837)

Git clone operations that go through an HTTPS proxy fail. Non-TLS (HTTP) proxies can be used successfully. (BZ#1750650)

Git clone operations fail in builds running behind a proxy if the source URIs use the git:// or ssh:// scheme. (BZ#1751738)

In OpenShift Container Platform 4.1, anonymous users could access discovery endpoints. Later releases revoked this access to reduce the possible attack surface for security exploits because some discovery endpoints are forwarded to aggregated API servers. However, unauthenticated access is preserved in upgraded clusters so that existing use cases are not broken.

## Snippet to remove unauthenticated group from all the cluster role bindings
$ for clusterrolebinding in cluster-status-binding discovery system:basic-user system:discovery system:openshift:discovery ;
do
### Find the index of unauthenticated group in list of subjects
index=$(oc get clusterrolebinding ${clusterrolebinding} -o json | jq 'select(.subjects!=null) | .subjects | map(.name=="system:unauthenticated") | index(true)');
### Remove the element at index from subjects array
oc patch clusterrolebinding ${clusterrolebinding} --type=json --patch "[{'op': 'remove','path': '/subjects/$index'}]";
done