RATATOSKRATATOSK
Sign in

Open Cluster Management

v1.4.0Orchestration & Management
Oct 7, 2026

ACTION 1OTHER 151

A maintenance release adds operator capabilities and configuration and policy options, alongside behavior improvements, bug fixes, and dependency updates. No security changes are disclosed.

Action needed (1)

  • breakingDeny NetworkPolicy deployment ordering

    The deployment order is fixed so the deny NetworkPolicy is deployed last.

All 151 other recorded changesvalue changes 87 · fixes 32 · additions 28 · constraints 4

value changes (87)

  • - feat: surface invalid ManifestWork owner label on MWRS status (#1602) @krishnankm
  • - fix: bind gRPC server status updates to the authenticated cluster and bump OCM deps to v1.4.0 (#1726) @mikeshng
  • - work: report NotAsExpected instead of PlacementDecisionEmpty when applies fail (#1703) @raviranjan6020
  • - Bump addon-framework to v1.3.1 and surface JobFailed status feedback (#1667) @stevekuznetsov
  • - Bump the gomod group with 2 updates (#1724) @dependabot[bot]
  • - Bump the aws group with 3 updates (#1723) @dependabot[bot]
  • - Bump github.com/onsi/gomega from 1.43.0 to 1.43.1 in the gomod group (#1719) @dependabot[bot]
  • - Bump open-cluster-management.io/addon-framework from 1.3.1-0.20260902141743-f80fc02deef8 to 1.3.1 in the open-cluster-management-io group (#1718) @dependabot[bot]
  • - Bump the aws group with 2 updates (#1717) @dependabot[bot]
  • - chore: update API depend for widen the awsirsa cluster ARN validation (#1713) @mikeshng
  • - chore: update all the deps so the dep bot can work properly again (#1678) @mikeshng
  • - Bump github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1 (#1654) @dependabot[bot]
  • - Bump the aws group across 1 directory with 5 updates (#1653) @dependabot[bot]
  • - Improve diagnostic message when hosted addon lease is not found (#1651) @mikeshng
  • - Bump google.golang.org/grpc from 1.82.1 to 1.83.0 (#1647) @dependabot[bot]
  • - Bump the aws group with 5 updates (#1646) @dependabot[bot]
  • - Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (#1641) @dependabot[bot]
  • - Bump the aws group across 1 directory with 4 updates (#1635) @dependabot[bot]
  • - Bump the aws group across 1 directory with 4 updates (#1626) @dependabot[bot]
  • - Bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#1625) @dependabot[bot]
  • - Bump github.com/google/cel-go from 0.29.1 to 0.29.2 (#1619) @dependabot[bot]
  • - Bump github.com/aws/aws-sdk-go-v2/config from 1.32.28 to 1.32.29 in the aws group (#1618) @dependabot[bot]
  • - Bump the aws group with 3 updates (#1617) @dependabot[bot]
  • - Bump github.com/google/cel-go from 0.29.0 to 0.29.1 (#1614) @dependabot[bot]
  • - Bump github.com/google/cel-go from 0.28.1 to 0.29.0 (#1613) @dependabot[bot]
  • - Bump the aws group across 1 directory with 5 updates (#1612) @dependabot[bot]
  • - Bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#1611) @dependabot[bot]
  • - Bump github.com/onsi/gomega from 1.42.0 to 1.42.1 (#1595) @dependabot[bot]
  • - Bump github.com/onsi/ginkgo/v2 from 2.31.0 to 2.32.0 (#1594) @dependabot[bot]
  • - Bump the aws group across 1 directory with 2 updates (#1588) @dependabot[bot]
  • - Bump helm.sh/helm/v3 from 3.21.0 to 3.21.1 (#1587) @dependabot[bot]
  • - Bump github.com/onsi/gomega from 1.41.0 to 1.42.0 (#1581) @dependabot[bot]
  • - Bump github.com/onsi/ginkgo/v2 from 2.30.0 to 2.31.0 (#1577) @dependabot[bot]
  • - Bump github.com/onsi/ginkgo/v2 from 2.29.0 to 2.30.0 (#1570) @dependabot[bot]
  • - Bump the aws group across 1 directory with 5 updates (#1558) @dependabot[bot]
  • - Bump the aws group across 1 directory with 5 updates (#1557) @dependabot[bot]
  • - chore: update base image to distroless (#1556) @dhaiducek
  • - Bump the aws group across 1 directory with 5 updates (#1549) @dependabot[bot]
  • - Bump the aws group across 1 directory with 2 updates (#1543) @dependabot[bot]
  • - Bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 (#1531) @dependabot[bot]
  • - Bump github.com/onsi/gomega from 1.40.0 to 1.41.0 (#1530) @dependabot[bot]
  • - Bump the k8s-io group across 1 directory with 2 updates (#1525) @dependabot[bot]
  • - Bump google.golang.org/grpc from 1.81.0 to 1.81.1 (#1524) @dependabot[bot]
  • - Bump helm.sh/helm/v3 from 3.20.2 to 3.21.0 (#1523) @dependabot[bot]
  • - Bump github.com/google/cel-go from 0.28.0 to 0.28.1 (#1521) @dependabot[bot]
  • - Bump github.com/onsi/ginkgo/v2 from 2.28.2 to 2.28.3 (#1518) @dependabot[bot]
  • * :seedling: Bump the aws group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/open-cluster-management-io/ocm/pull/1491
  • * :seedling: Bump the aws group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/open-cluster-management-io/ocm/pull/1543
  • * :seedling: Bump the aws group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/open-cluster-management-io/ocm/pull/1549
  • :seedling: chore: update base image to distroless
  • :seedling: Bump github.com/onsi/ginkgo/v2 from … to …×3
  • :seedling: Bump github.com/onsi/gomega from … to …×2
  • :seedling: Bump the aws group across 1 directory with 5 updates×3
  • :seedling: Bump helm.sh/helm/v3 from 3.21.0 to 3.21.1
  • :seedling: Bump the aws group across 1 directory with 2 updates
  • :seedling: Bump github.com/google/cel-go from … to …×3
  • :sparkles: feat: surface invalid ManifestWork owner label on MWRS status
  • :seedling: Bump google.golang.org/grpc from … to …×3
  • :seedling: Bump the aws group with 3 updates×2
  • :seedling: Bump github.com/aws/aws-sdk-go-v2/config from 1.32.28 to 1.32.29 in the aws group
  • :seedling: Bump the aws group across 1 directory with 4 updates×2
  • :seedling: Bump the k8s-io group across 1 directory with 2 updates
  • :seedling: Bump the aws group with 5 updates
  • :seedling: Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1
  • :sparkles: feat: generate SIG Multicluster PlacementDecision from OCM PlacementDecision behind feature gate
  • ✨ Update work-controller to emit logs on ManifestWork apply
  • 🐛Bump addon-framework to v1.3.1 and surface JobFailed status feedback×2
  • :seedling: chore: update all the deps so the dep bot can work properly again
  • :bug: switch registration/work image base to ubi-minimal so the AWS CLI plugin can load libz.so.1
  • :seedling: chore: update API depend for widen the awsirsa cluster ARN validation
  • :seedling: Bump github.com/onsi/gomega from 1.43.0 to 1.43.1 in the gomod group
  • :seedling: Bump the aws group with 2 updates
  • :seedling: Bump open-cluster-management.io/addon-framework from 1.3.1-0.20260902141743-f80fc02deef8 to 1.3.1 in the open-cluster-management-io group
  • :seedling: Bump the gomod group with 2 updates
  • :bug: fix: bind gRPC server status updates to the authenticated cluster and bump OCM deps to v1.4.0

fixes (32)

  • - fix: bind gRPC server status updates to the authenticated cluster and bump OCM deps to v1.4.0 (#1726) @mikeshng
  • - switch registration/work image base to ubi-minimal so the AWS CLI plugin can load libz.so.1 (#1701) @darylsmit-rgb
  • - fix: support Deployment replica overrides via AODC replicaConfigs (#1700) @amancse
  • - fix: skip default ClusterSet labeling (#1692) @dhaiducek
  • - feat: use hash-based owner label for ManifestWorkReplicaSet (#1684) @payjain
  • - derive hosting-cluster-name on MCA create for hosted clusters (#1679) @rokej
  • - Fix quality issues across 8 Part 2 solution integrations (#1656) @payjain
  • - keep registration annotations flag ordering consistent on each reconcile (#1644) @arturshadnik
  • - Apply TLS profile to operator and agent serving endpoints (#1639) @tesshuflower
  • - fix(placement): use correct SAR verb on debug permission checks (#1623) @rokej
  • - fix: preserve config reference ordering in cmainstallprogression controller (#1610) @tesshuflower
  • - Fix config references order (#1601) @KevinFCormier
  • - fix(placement): return correct HTTP status codes from debug endpoint (#1593) @rokej
  • - Start csr informer in awsirsa driver (#1569) @minmul117
  • - fix: properly detect empty CONTAINER_CLI (#1554) @dhaiducek
  • - Add cluster.local FQDN to PlacementDebugServer cert SANs (#1533) @Randy424
  • - OCM v1beta1 mca conversion fix issue 1526 (#1527) @tesshuflower
  • - fix: update CSV with placement-debug RBAC (#1567) @dhaiducek
  • :bug: Start csr informer in awsirsa driver
  • :bug: fix(placement): return correct HTTP status codes from debug endpoint
  • :bug: fix: preserve config reference ordering in cmainstallprogression controller
  • :bug: fix(placement): use correct SAR verb on debug permission checks
  • 🐛 keep registration annotations flag ordering consistent on each reconcile
  • :bug: Apply TLS profile to operator and agent serving endpoints
  • :bug: Fix quality issues across 8 Part 2 solution integrations
  • :bug: derive hosting-cluster-name on MCA create for hosted clusters
  • :bug: fix: skip default ClusterSet labeling
  • :bug: Fix config references order
  • :bug: feat: use hash-based owner label for ManifestWorkReplicaSet
  • :bug: work: report NotAsExpected instead of PlacementDecisionEmpty when applies fail
  • :bug: fix: bind gRPC server status updates to the authenticated cluster and bump OCM deps to v1.4.0
  • :bug: fix: deploy deny NetworkPolicy last

additions (28)

  • - Add ManifestWork apply metrics (#1721) @pvsh1804
  • - feature : add hub cluster name to Klusterlet controller (#1711) @Arunamanivannan
  • - feat(registration): support clusterLabels for klusterlet (#1687) @payjain
  • - feat: add klusterlet hosting-cluster self-report opt-in (KEP-188) (#1674) @mikeshng
  • - Update work-controller to emit logs on ManifestWork apply (#1658) @jeffw17
  • - feat: add NetworkPolicies for open-cluster-management-hub namespace (#1634) @amancse
  • - feat: add NetworkPolicies for open-cluster-management-agent namespace (#1627) @mihirlele
  • - AddOnTemplate v1beta1 implementation (#1621) @mikeshng
  • - feat: add extraVolumes and extraVolumeMounts support to klusterlet helm chart (#1575) @digvijay-y
  • - feat: add annotation to skip managed cluster clock sync check (#1574) @gauravshinde1729
  • - feat: add verify-csv check (#1568) @dhaiducek
  • - feature: expose flags to configure spoke agent controller workers (#1560) @Vaishnav88sk
  • - feat: generate SIG Multicluster PlacementDecision from OCM PlacementDecision behind feature gate (#1552) @mikeshng
  • - Add imagePullSecrets support to cluster-manager helm chart (#1539) @blueprismo
  • - Bump addon-framework to v1.3.1 and surface JobFailed status feedback (#1667) @stevekuznetsov
  • * :seedling: Add CertRotationController support for PlacementDebugServer TLS by @Randy424 in https://github.com/open-cluster-management-io/ocm/pull/1494
  • * :sparkles: Add TLS profile configuration support for spoke cluster agents by @shivansh-source in https://github.com/open-cluster-management-io/ocm/pull/1486
  • :sparkles: feat: add annotation to skip managed cluster clock sync check
  • ✨ feature: expose flags to configure spoke agent controller workers
  • :sparkles: feat: add extraVolumes and extraVolumeMounts support to klusterlet helm chart
  • ✨ Add imagePullSecrets support to cluster-manager helm chart
  • :sparkles: AddOnTemplate v1beta1 implementation
  • :sparkles: feat: add NetworkPolicies for open-cluster-management-agent namespace
  • :sparkles: feat: add NetworkPolicies for open-cluster-management-hub namespace
  • :sparkles: feat: add klusterlet hosting-cluster self-report opt-in (KEP-188)
  • :sparkles: feat(registration): support clusterLabels for klusterlet
  • ✨ feature : add hub cluster name to Klusterlet controller
  • :sparkles: Add ManifestWork apply metrics

constraints (4)

  • - Allow gov aws arn (#1704) @suvaanshkumar
  • :bug: fix: support Deployment replica overrides via AODC replicaConfigs
  • :bug: Allow gov aws arn
  • :seedling: chore: update API depend for widen the awsirsa cluster ARN validation
Add Open Cluster Management to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Open Cluster Management releases →