Original: * Previously, contents of the `MachineConfig` and `ControllerConfig` resources from group `machineconfiguration.openshift.io` were not excluded from audit logs. With this release, they are excluded from audit logs because they might contain secrets. (link:https://issues.redhat.com/browse/OCPBUGS-55709[OCPBUGS-55709])
* Previously, the kube-apiserver service level objective (SLO) alert expression incorrectly summed read and write success ratios independently of total request volume. This led to misleading burn rate calculations during disruptions. With this release, the fix adjusts the calculation to properly weight success ratios by total request count. This results in accurate and reliable alerting based on the true proportion of successful requests. (link:https://issues.redhat.com/browse/OCPBUGS-49764[OCPBUGS-49764])
* Previously, cluster bootstrap removal could break kube-apiserver readiness if etcd access was lost which could lead to downtime. With this release, each kube-apiserver has 2 stable etcd endpoints before removing bootstrap which maintains availability during rollout. (link:https://issues.redhat.com/browse/OCPBUGS-48673[OCPBUGS-48673])
* Previously, the Static Pod Operator API allowed invalid node statuses with unset `currentRevision` and multiple nonzero `targetRevision` entries, which led to failures in node and installer controllers. With this release, new validation rules were added to enforce correct revision fields to ensure stable and consistent static pod status handling. (link:https://issues.redhat.com/browse/OCPBUGS-46380[OCPBUGS-46380])
* Previously, the node controller applied stale `NodeStatus` data from its lister, unintentionally overwriting recent updates from other controllers. With this release, the fix uses managed fields to let controllers update separate entries without conflict which preserves accurate and concurrent node status updates. (link:https://issues.redhat.com/browse/OCPBUGS-46372[OCPBUGS-46372])
* Previously, a fixed five minute timeout for removing the etcd bootstrap member started too early. This led to premature failures in HA clusters despite sufficient overall time. With this release, the narrow timeout is removed to rely on overall bootstrap progress instead, which ensures reliable and quorum-safe etcd bootstrap removal. (link:https://issues.redhat.com/browse/OCPBUGS-46363[OCPBUGS-46363])
* Previously, when the temporary control plane was down, the `networkConfig.status.ServiceNetwork` was not populated, and when generated certificates did not have the Kubernetes service IP in the SANs, the clients would fail to connect to the kube-apiserver through the default kubernetes service. With this release, a guard has been added to skip certificated generation if `networkConfig.status.ServiceNetwork` is nil. Client connections will be stable and valid. (link:https://issues.redhat.com/browse/OCPBUGS-45943[OCPBUGS-45943])
* Previously, the installer deleted the bootstrap machine before the etcd member was removed. This led to quorum loss in HA clusters. With this release, the check from SNO is extended to all topologies, using the etcd operator's condition as a safe removal sign, which ensures etcd cluster stability during bootstrap teardown. (link:https://issues.redhat.com/browse/OCPBUGS-45482[OCPBUGS-45482])
Revised: * Previously, the OpenShift API server might panic when both image and error fields were unset during CRD request handling. This led to runtime crashes and instability in the API server under certain conditions. With this release, a guard is added to ensure no panic occurs by safely handling the case when both fields are unset, resulting in a more robust and stable CRD request handling process without crashes. (link:https://issues.redhat.com/browse/OCPBUGS-45861[OCPBUGS-45861])