Which 4.y.z to 4.y'.z' updates increase vulnerability?

• Any update to 4.17 between 4.17.11 and 4.17.24 (inclusive)

Which types of clusters?

• There is some machine config name listed in ContainerRuntimeConfig metadata.finalizers, but the machine config object does not exist on the cluster. This condition can happen on clusters that were previously affected by earlier OCPBUGS-7719 bug.

What is the impact? Is it serious enough to warrant removing update recommendations?

• The Machine Config Operator (MCO) enters a Degraded state during the update and the update never completes

How involved is remediation?

Admin can

1. check the containerruntimeconfig metadata.finalizers field: oc get containerruntimeconfigs.machineconfiguration.openshift.io <config-name> -o yaml
2. run oc get machineconfigs.machineconfiguration.openshift.io to get a list of existing MachineConfigs
3. run oc edit to remove finalizers referencing MachineConfigs that don't  present in the cluster: oc edit containerruntimeconfigs.machineconfiguration.openshift.io <config-name>

Is this a regression?

• Yes, from 4.y.z to 4.17.(z>=11).