# 4.19.0-okd-scos.8

Created: 2025-07-15 21:15:32 +0000 UTC

Image Digest: `sha256:aa726dc763d93ae932f894f73a5306ec6d41c958f566ba84ef990eba4d14fe30`

Promoted from registry.ci.openshift.org/origin/release-scos:4.19.0-0.okd-scos-2025-07-15-040524


## Changes from 4.19.0-okd-scos.6

### Components

* Kubectl 1.32.1
* Kubernetes upgraded from 1.32.5 to 1.32.6
* Kubernetes Tests 1.32.5
* CentOS Stream CoreOS upgraded from 9.0.20250611-0 to 9.0.20250713-0


### Rebuilt images without code change

* [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator) git [227f7537](https://github.com/openshift/cluster-autoscaler-operator/commit/227f7537c3b459d4940522809df60b2dfca738ed) `sha256:f539eb3cfebd4801084621a6fa0d07b64a946c98abd0a0aa60ed9bc4c406753e`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/ed2ed7381926234c8f8dec4fd15a01febf935acc)

* [MGMT-20893](https://issues.redhat.com/browse/MGMT-20893): Remove Remediation operators from virtualization bundle (#7814) [#7814](https://github.com/openshift/assisted-service/pull/7814)
* [OCPBUGS-57361](https://issues.redhat.com/browse/OCPBUGS-57361): Use hostname to match hosts to BMH ignition (#7794) [#7794](https://github.com/openshift/assisted-service/pull/7794)
* [Full changelog](https://github.com/openshift/assisted-service/compare/d4d43dd72253e7c8c3ce4a3a1779aef3f59b251a...ed2ed7381926234c8f8dec4fd15a01febf935acc)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/df463ff90afcaeb63e52b2e2ac174a557d0b869b)

* [OCPBUGS-57922](https://issues.redhat.com/browse/OCPBUGS-57922): Update operators list in ISOBuilder [#118](https://github.com/openshift/agent-installer-utils/pull/118)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/8cc39210ed284ff6c597815dee379ef4bfeb9d77...df463ff90afcaeb63e52b2e2ac174a557d0b869b)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/04987a4f8fbf36196044db0e1863cb0febf4a88e)

* [OCPBUGS-56163](https://issues.redhat.com/browse/OCPBUGS-56163): [release-4.19] Update virtualmachines service to armcompute/v5 SDK [#144](https://github.com/openshift/machine-api-provider-azure/pull/144)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/249e31eba655572a52f44c6065bc251341544883...04987a4f8fbf36196044db0e1863cb0febf4a88e)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/249d7428c51fe85cabdab6394c4aed86fc24d398)

* [OCPBUGS-56963](https://issues.redhat.com/browse/OCPBUGS-56963): Make swift containers removal not fatal for UPI. [#9765](https://github.com/openshift/installer/pull/9765)
* [OCPBUGS-58403](https://issues.redhat.com/browse/OCPBUGS-58403): When AWS_PROFILE is invalid ask for credentials [#9829](https://github.com/openshift/installer/pull/9829)
* [OCPBUGS-58073](https://issues.redhat.com/browse/OCPBUGS-58073): Refactor removing loadbalancer in OpenStack. [#9808](https://github.com/openshift/installer/pull/9808)
* [OCPBUGS-58263](https://issues.redhat.com/browse/OCPBUGS-58263): allow to deploy single nodes with UPI [#9812](https://github.com/openshift/installer/pull/9812)
* [OCPBUGS-57901](https://issues.redhat.com/browse/OCPBUGS-57901): vSphere - remove unit tests using nip.io [#9802](https://github.com/openshift/installer/pull/9802)
* [OCPBUGS-58060](https://issues.redhat.com/browse/OCPBUGS-58060): MCO: consider custom AMI for edge compute machine pool [#9807](https://github.com/openshift/installer/pull/9807)
* [Full changelog](https://github.com/openshift/installer/compare/e1b37acef872454997045f6b14119808a473357a...249d7428c51fe85cabdab6394c4aed86fc24d398)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/b88332dc3d583aeb36ddb06a1a6fa7935ccf780c)

* [OCPBUGS-56765](https://issues.redhat.com/browse/OCPBUGS-56765): Make firmware update handle only a subset of `Spec.Updates` [#420](https://github.com/openshift/baremetal-operator/pull/420)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/aa46a5a6144b865dbcdb8af35d13a790377542d4...b88332dc3d583aeb36ddb06a1a6fa7935ccf780c)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/33a1d92344c6b56721a745fbe2e41d3ca899aa78)

* [OCPBUGS-57781](https://issues.redhat.com/browse/OCPBUGS-57781): iptables: Switch PREROUTING REDIRECT rule to DNAT instead [#352](https://github.com/openshift/baremetal-runtimecfg/pull/352)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/b94d92874ab36d9d3ee26dda59f172611fca18fb...33a1d92344c6b56721a745fbe2e41d3ca899aa78)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/298429ba9831d1d72b89edd9beb82a6ee665c3b7)

* [OCPBUGS-58077](https://issues.redhat.com/browse/OCPBUGS-58077): Return error in case of error [#2052](https://github.com/openshift/oc/pull/2052)
* [Full changelog](https://github.com/openshift/oc/compare/fa1fd955cefab1204764bc98d754ed855ba6dca4...298429ba9831d1d72b89edd9beb82a6ee665c3b7)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/ae646da0856ff25229c23f1adaf08280b98e2e95)

* [OCPBUGS-58246](https://issues.redhat.com/browse/OCPBUGS-58246): ccoctl: only add owned tag to azure resources on create [#881](https://github.com/openshift/cloud-credential-operator/pull/881)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/675dad516b5d96d4ecaa2df6461e2145204850f4...ae646da0856ff25229c23f1adaf08280b98e2e95)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/0c3beae1a216187270d60af49117a82e74de4020)

* [OCPBUGS-57504](https://issues.redhat.com/browse/OCPBUGS-57504): Treat ResourceNotFound as non-fatal [#484](https://github.com/openshift/cluster-baremetal-operator/pull/484)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/c937e467ef097482b65f18c09ede444798bf8bd9...0c3beae1a216187270d60af49117a82e74de4020)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/23220358f864338ab01ba0eb55d20459c732be64)

* [OCPBUGS-57449](https://issues.redhat.com/browse/OCPBUGS-57449): mapi2capi: Create new machine template when changing MAPI providerSpec [#317](https://github.com/openshift/cluster-capi-operator/pull/317)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/ee69183571b592073a7163c5aef34d1a970a8c19...23220358f864338ab01ba0eb55d20459c732be64)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/afc5cf84c188843a21b3880d26b334164d0c0477)

* [OCPBUGS-57490](https://issues.redhat.com/browse/OCPBUGS-57490): Comply with OCP pod standards for TNF jobs [#1434](https://github.com/openshift/cluster-etcd-operator/pull/1434)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/e654299baac2e333b86db9d5f8ec69dabbff0e3c...afc5cf84c188843a21b3880d26b334164d0c0477)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/137807b212e6c24b59073a43fb10ccf6fed2a250)

* [OCPBUGS-58394](https://issues.redhat.com/browse/OCPBUGS-58394): desiredIstio: Do not enable a default PDB [#1241](https://github.com/openshift/cluster-ingress-operator/pull/1241)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/6d54169d4c6643ae9b6ff81b3a21b929934062fa...137807b212e6c24b59073a43fb10ccf6fed2a250)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/cd86a6772107b5213da2e649530b1a64eb6c2781)

* Revert "[release-4.19] OCPBUGS-58116: certregenerationcontroller: start configInformers again" [#1867](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1867)
* [OCPBUGS-58116](https://issues.redhat.com/browse/OCPBUGS-58116): certregenerationcontroller: start configInformers again [#1861](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1861)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/34bd8a7860802d310b4b0c124dc7975b6fa52773...cd86a6772107b5213da2e649530b1a64eb6c2781)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/61b6637d88503c5ddaace05a3e7a3f0b04d49183)

* [OCPBUGS-52853](https://issues.redhat.com/browse/OCPBUGS-52853): Do not add iommu.passthrough to ARM by default (#1358) [#1358](https://github.com/openshift/cluster-node-tuning-operator/pull/1358)
* [OCPBUGS-58144](https://issues.redhat.com/browse/OCPBUGS-58144): E2E: Additional Functional tests for align cpus by UncoreCache Feature (#1348) [#1348](https://github.com/openshift/cluster-node-tuning-operator/pull/1348)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/174ae084670fb9775fe901053bfc3284facf9afa...61b6637d88503c5ddaace05a3e7a3f0b04d49183)


### [console](https://github.com/openshift/console/tree/d3cacbbc55bbe7ec4f44e8f119afb56d438a85c1)

* [OCPBUGS-58183](https://issues.redhat.com/browse/OCPBUGS-58183): ContainerResource metric data for HPAs isn't visible i… [#15213](https://github.com/openshift/console/pull/15213)
* [OCPBUGS-58316](https://issues.redhat.com/browse/OCPBUGS-58316): Implement sessions in openshift authenticator [#15234](https://github.com/openshift/console/pull/15234)
* [OCPBUGS-58375](https://issues.redhat.com/browse/OCPBUGS-58375): fix bug where / in console.tab/horizontalNav href breaks navigation [#15239](https://github.com/openshift/console/pull/15239)
* [OCPBUGS-58377](https://issues.redhat.com/browse/OCPBUGS-58377): fix runtime error when editing HPA using the form [#15240](https://github.com/openshift/console/pull/15240)
* [OCPBUGS-58090](https://issues.redhat.com/browse/OCPBUGS-58090): Cannot read properties of undefined (reading 'node-role.kubernetes.io/master') error while accessing node logs from console [#15204](https://github.com/openshift/console/pull/15204)
* NO-JIRA: Update Console plugin SDK changelogs [#15212](https://github.com/openshift/console/pull/15212)
* [Full changelog](https://github.com/openshift/console/compare/477eb1aa13f3eb4adb82d2fdc82cd23f5295a101...d3cacbbc55bbe7ec4f44e8f119afb56d438a85c1)


### [console-operator](https://github.com/openshift/console-operator/tree/ef37393645f673f7fd69c44a5cd5fe3f95b153cf)

* [OCPBUGS-58400](https://issues.redhat.com/browse/OCPBUGS-58400): Disable LightSpeed dialog on non amd64 architecture (#1011) [#1011](https://github.com/openshift/console-operator/pull/1011)
* [Full changelog](https://github.com/openshift/console-operator/compare/0cb29273c8b1efec6ca591d5259a69d34e5ce51f...ef37393645f673f7fd69c44a5cd5fe3f95b153cf)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/38c60a516ecb061270b0f0f05239b8fe2ce4bf0e)

* [OCPBUGS-57886](https://issues.redhat.com/browse/OCPBUGS-57886): Bump 4.19 1.32.6 [#2340](https://github.com/openshift/kubernetes/pull/2340)
* NO-JIRA: UPSTREAM: <carry>: Update rebase.sh to handle go versions major.minor.patch [#2341](https://github.com/openshift/kubernetes/pull/2341)
* [OCPBUGS-58175](https://issues.redhat.com/browse/OCPBUGS-58175): Fix flake caused by invalid detection of active policies in VAP integration tests [#2347](https://github.com/openshift/kubernetes/pull/2347)
* [OCPBUGS-55937](https://issues.redhat.com/browse/OCPBUGS-55937): UPSTREAM: <carry>: Mark admissionregistration.k8s.io/v1beta1 as deprecated. [#2290](https://github.com/openshift/kubernetes/pull/2290)
* [Full changelog](https://github.com/openshift/kubernetes/compare/fadb78e720779ed1b29f32170f3e9dd32584a7e6...38c60a516ecb061270b0f0f05239b8fe2ce4bf0e)


### [hypershift](https://github.com/openshift/hypershift/tree/da32b47345c6a1ce4fa2981390292bdbe79334e8)

* [OCPBUGS-59101](https://issues.redhat.com/browse/OCPBUGS-59101): Configure ClusterServiceLoadBalancerHea… [#6409](https://github.com/openshift/hypershift/pull/6409)
* NO-JIRA: chore(deps): update konflux references [#6383](https://github.com/openshift/hypershift/pull/6383)
* NO-JIRA: [release-4.19] CNTRLPLANE-1042: Disable createClusterNone for azure and scope down verifyResourceGroupLocationsMatch check [#6392](https://github.com/openshift/hypershift/pull/6392)
* [OCPBUGS-57660](https://issues.redhat.com/browse/OCPBUGS-57660): [release-4.19] CORENET-6094: CNO: add FRR-k8s image [#6374](https://github.com/openshift/hypershift/pull/6374)
* [OCPBUGS-58335](https://issues.redhat.com/browse/OCPBUGS-58335): Support proxy authentication when user/pass is included in URL [#6370](https://github.com/openshift/hypershift/pull/6370)
* [CNTRLPLANE-1044](https://issues.redhat.com/browse/CNTRLPLANE-1044): chore(deps): update konflux references [#6342](https://github.com/openshift/hypershift/pull/6342)
* [ACM-21713](https://issues.redhat.com/browse/ACM-21713): adding .git in .dockerignore to fix version info [#6318](https://github.com/openshift/hypershift/pull/6318)
* [CNV-61396](https://issues.redhat.com/browse/CNV-61396): Sync RBAC for expansion support in kubevirt CSI driver [#6255](https://github.com/openshift/hypershift/pull/6255)
* [CNTRLPLANE-374](https://issues.redhat.com/browse/CNTRLPLANE-374): hcco: handle post-install creation of OIDC client secrets [#6296](https://github.com/openshift/hypershift/pull/6296)
* [OCPBUGS-57485](https://issues.redhat.com/browse/OCPBUGS-57485): Don't use /version for haproxy health checks [#6292](https://github.com/openshift/hypershift/pull/6292)
* [Full changelog](https://github.com/openshift/hypershift/compare/be8f469666af1578821c8aa01337e03e5c09eb33...da32b47345c6a1ce4fa2981390292bdbe79334e8)


### [insights-operator](https://github.com/openshift/insights-operator/tree/a27774d09621a76c1ec95212c4b8047d0f3b3450)

* [OCPBUGS-56781](https://issues.redhat.com/browse/OCPBUGS-56781): Enhance insights-runtime-extractor errors (#1089) [#1089](https://github.com/openshift/insights-operator/pull/1089)
* [Full changelog](https://github.com/openshift/insights-operator/compare/02f44737de3a93330de16f138b0f688fe1daefce...a27774d09621a76c1ec95212c4b8047d0f3b3450)


### [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver/tree/f535e9a1a27ebfeca0fa1ac33f19383f46629141)

* "[release-4.19] OCPBUGS-58239: Implement volume expansion" [#64](https://github.com/openshift/kubevirt-csi-driver/pull/64)
* [Full changelog](https://github.com/openshift/kubevirt-csi-driver/compare/e3027025743b10d8a1df75afcf9c28d4ac8dbf3f...f535e9a1a27ebfeca0fa1ac33f19383f46629141)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/e5bb80c194b2d707e16e737dbed61c8ab33e3d57)

* [OCPBUGS-58894](https://issues.redhat.com/browse/OCPBUGS-58894): Remove podman-etcd machine config source [#5169](https://github.com/openshift/machine-config-operator/pull/5169)
* [OCPBUGS-59208](https://issues.redhat.com/browse/OCPBUGS-59208): Backport QE ported test for OCL component readiness [#5125](https://github.com/openshift/machine-config-operator/pull/5125)
* [OCPBUGS-58820](https://issues.redhat.com/browse/OCPBUGS-58820): Add control-plane label for master nodes on legacy clusters [#5168](https://github.com/openshift/machine-config-operator/pull/5168)
* [OCPBUGS-57327](https://issues.redhat.com/browse/OCPBUGS-57327): Do not set cpu system reserve below the default value [#5117](https://github.com/openshift/machine-config-operator/pull/5117)
* [OCPBUGS-57689](https://issues.redhat.com/browse/OCPBUGS-57689): Ensure the build controller restarts on upgrade [#5127](https://github.com/openshift/machine-config-operator/pull/5127)
* [OCPBUGS-57930](https://issues.redhat.com/browse/OCPBUGS-57930): OCPBUGS-57506: Boot image controller should correctly handle marketplace boot images [#5135](https://github.com/openshift/machine-config-operator/pull/5135)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/37599558c086c22c11655523316bb1e6fb9eddc2...e5bb80c194b2d707e16e737dbed61c8ab33e3d57)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/da1e4eed5a198ac9265e33132e208d60cf4a8d39)

* [OU-744](https://issues.redhat.com/browse/OU-744): [release-4.19]: fix: set correct pf color for gradient background on legacy dashboards legend [#457](https://github.com/openshift/monitoring-plugin/pull/457)
* [OU-880](https://issues.redhat.com/browse/OU-880): [release-4.19] Manual cherry pick ou 880 [#458](https://github.com/openshift/monitoring-plugin/pull/458)
* [OU-842](https://issues.redhat.com/browse/OU-842): [release-4.19] fix: override notistack dependency to avoid conflict [#455](https://github.com/openshift/monitoring-plugin/pull/455)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/73a8e79b19fd6f89ff13b760e00d010ffae4c065...da1e4eed5a198ac9265e33132e208d60cf4a8d39)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/f74e8e006cd47ae9b7cab525796f53af8fb1da9c)

* [OCPBUGS-58836](https://issues.redhat.com/browse/OCPBUGS-58836): 4.19 kube 1.32 [#318](https://github.com/openshift/oauth-proxy/pull/318)
* [OCPBUGS-58343](https://issues.redhat.com/browse/OCPBUGS-58343): release 4.19 CVE fixes [#326](https://github.com/openshift/oauth-proxy/pull/326)
* [OCPBUGS-58276](https://issues.redhat.com/browse/OCPBUGS-58276): fix e2e tests [#323](https://github.com/openshift/oauth-proxy/pull/323)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/3d12ccbee45c5d4bcea8c232867df58a60c4382b...f74e8e006cd47ae9b7cab525796f53af8fb1da9c)


### [oauth-server](https://github.com/openshift/oauth-server/tree/14780f7c67d5929c3db84504d10625710fcf5fe0)

* [OCPBUGS-57282](https://issues.redhat.com/browse/OCPBUGS-57282): Updating oauth-server-container image to be consistent with ART for 4.19 [#183](https://github.com/openshift/oauth-server/pull/183)
* [Full changelog](https://github.com/openshift/oauth-server/compare/6acb955fc87e1d487093217ca949f08eb8dc88c3...14780f7c67d5929c3db84504d10625710fcf5fe0)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/9283907f659b8196cf0a9a45b9c4b0016edb25d5)

* [OCPBUGS-58193](https://issues.redhat.com/browse/OCPBUGS-58193): v2/archive: error d2m when no tar files found (#1200) (#1207) [#1200](https://github.com/openshift/oc-mirror/pull/1200)
* [OCPBUGS-58279](https://issues.redhat.com/browse/OCPBUGS-58279): v2/defaults Fix rate limiting issues by enabling exponential backoff retries (#1205) [#1205](https://github.com/openshift/oc-mirror/pull/1205)
* [OCPBUGS-58271](https://issues.redhat.com/browse/OCPBUGS-58271): Fixes the tag when rebuilt catalog by digest only (#1203) [#1203](https://github.com/openshift/oc-mirror/pull/1203)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/e8a1ce3d1973ef2fb5870ea6abe7ee6d7c0d8ae5...9283907f659b8196cf0a9a45b9c4b0016edb25d5)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/8f42f09b2a9faecefb6ab22afe4a75c1a8d5a584)

* UPSTREAM: <carry>: Safely handle changes to description fields (#2023) [#2023](https://github.com/openshift/operator-framework-operator-controller/pull/2023)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/416a2d35da535db1d50211dbc13b22a909cda781...8f42f09b2a9faecefb6ab22afe4a75c1a8d5a584)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/7fe57362c4f64c0d4caf52a0bb26a59b2799b227)

* [OCPBUGS-57206](https://issues.redhat.com/browse/OCPBUGS-57206): Wire dry run option to Image API server operations [#524](https://github.com/openshift/openshift-apiserver/pull/524)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/18061bfe9586919421ed2bb342d9b326b1002bd7...7fe57362c4f64c0d4caf52a0bb26a59b2799b227)


### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/a672407574befa9faf6a56078d6852229701f8c6)

* [OCPBUGS-57951](https://issues.redhat.com/browse/OCPBUGS-57951): ignore error failing to find pull/push secrets [#401](https://github.com/openshift/openshift-controller-manager/pull/401)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/af43fe68a7d862959a797b66307a1277fffbc9df...a672407574befa9faf6a56078d6852229701f8c6)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/0e4e456e8183103a071b57bf19e989eda5162f8c)

* [OCPBUGS-58259](https://issues.redhat.com/browse/OCPBUGS-58259): Reduce Frequency of Update Requests for Copied CSVs (#3597) [release-4.19] [#1030](https://github.com/openshift/operator-framework-olm/pull/1030)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/4a6530a4cf4e8e81d8f04923f36dd36023f45902...0e4e456e8183103a071b57bf19e989eda5162f8c)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/0b613e37a01ed51b5c890a43cf034480bb68241c)

* [OCPBUGS-59106](https://issues.redhat.com/browse/OCPBUGS-59106): DownStream Merge Sync from 4.20 [06-18-2025] [#2642](https://github.com/openshift/ovn-kubernetes/pull/2642)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/0c8cdc93873c06b07973d147fc704d2224ac2faf...0b613e37a01ed51b5c890a43cf034480bb68241c)


### [stream-coreos, stream-coreos-extensions](https://github.com/openshift/os/tree/334ed7c68677a737579fe0f4f9eaa74ca67ea817)

* [OCPBUGS-58122](https://issues.redhat.com/browse/OCPBUGS-58122): [TNF] OCP Two Node with Fencing symlink begone! [#1827](https://github.com/openshift/os/pull/1827)
* [Full changelog](https://github.com/openshift/os/compare/2acbcb0f9ef2e451f0138f1c33066fa6fa02ae20...334ed7c68677a737579fe0f4f9eaa74ca67ea817)


### [tests](https://github.com/openshift/origin/tree/506747ce9d1504a4b777b5124dff78e573249add)

* [OCPBUGS-58470](https://issues.redhat.com/browse/OCPBUGS-58470): Update IPsec e2e test to validate NAT-T encapsulation option [#29957](https://github.com/openshift/origin/pull/29957)
* [OCPBUGS-57206](https://issues.redhat.com/browse/OCPBUGS-57206): Backport pr 29834 to release-4.19 [#29903](https://github.com/openshift/origin/pull/29903)
* [OCPBUGS-58204](https://issues.redhat.com/browse/OCPBUGS-58204): Fix MCN test on agent compact FIPS jobs [#29943](https://github.com/openshift/origin/pull/29943)
* [OCPBUGS-58053](https://issues.redhat.com/browse/OCPBUGS-58053): [release-4.19] MCO-1768: Enable PIS testing on Metal [#29936](https://github.com/openshift/origin/pull/29936)
* [OCPBUGS-57436](https://issues.redhat.com/browse/OCPBUGS-57436): Add MCO test suite to 4.19 [#29918](https://github.com/openshift/origin/pull/29918)
* [OCPBUGS-57930](https://issues.redhat.com/browse/OCPBUGS-57930): Boot image controller should correctly handle marketplace boot images [#29935](https://github.com/openshift/origin/pull/29935)
* [OCPBUGS-57217](https://issues.redhat.com/browse/OCPBUGS-57217): Stabilize custom MCP cleanup on MCN tests [#29902](https://github.com/openshift/origin/pull/29902)
* [Full changelog](https://github.com/openshift/origin/compare/827e2ac2372ade0708488e95e3c8e98b083617a0...506747ce9d1504a4b777b5124dff78e573249add)