# 4.20.0-okd-scos.12

Created: 2025-12-08 05:30:34 +0000 UTC

Image Digest: `sha256:9c0435c9552cfa98248532d3e8b0ecd7020ca332ba2a0bba21d2c8f0185d8fb5`

Promoted from registry.ci.openshift.org/origin/release-scos:4.20.0-0.okd-scos-2025-12-07-131728


## Changes from 4.20.0-okd-scos.10

### Components

* Kubectl 1.33.3
* Kubernetes upgraded from 1.33.5 to 1.33.6
* Kubernetes Tests 1.33.4
* CentOS Stream CoreOS 10.0.20251023-0


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/43bfecff9fdba24bfa8ce1ffdcb3a7d72b6e6286)

* [OCPBUGS-57606](https://issues.redhat.com/browse/OCPBUGS-57606): Updating ose-agent-installer-api-server-container image to be consist… [#8399](https://github.com/openshift/assisted-service/pull/8399)
* [Full changelog](https://github.com/openshift/assisted-service/compare/4b116f46ca39a4933cab5647e5db44432c752b80...43bfecff9fdba24bfa8ce1ffdcb3a7d72b6e6286)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/637327ec40cd1f85ac5d7d4f114a2fae89baa8b0)

* [OCPBUGS-57718](https://issues.redhat.com/browse/OCPBUGS-57718): Update golang images to 1.24 for OpenShift 4.20 [#1194](https://github.com/openshift/assisted-installer-agent/pull/1194)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/62dc63f18f2c4a6a0cf1043710d055fe57f8fa28...637327ec40cd1f85ac5d7d4f114a2fae89baa8b0)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/cb0b70c71609b094c4949b2dc3e6213efb28c056)

* [OCPBUGS-66425](https://issues.redhat.com/browse/OCPBUGS-66425): Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 13cf619 [#186](https://github.com/openshift/agent-installer-utils/pull/186)
* [OCPBUGS-66422](https://issues.redhat.com/browse/OCPBUGS-66422): Update Konflux references [#185](https://github.com/openshift/agent-installer-utils/pull/185)
* [OCPBUGS-66406](https://issues.redhat.com/browse/OCPBUGS-66406): Update Konflux release version to 4.20.6 [#204](https://github.com/openshift/agent-installer-utils/pull/204)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/21a28dedb4012a4b8235b7f29d7c5db5f3386a96...cb0b70c71609b094c4949b2dc3e6213efb28c056)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/878ef6cbe06fabf3cb82ad0ca1c1226e03dfef91)

* [OCPBUGS-65895](https://issues.redhat.com/browse/OCPBUGS-65895): allow all-egress for efs operator [#473](https://github.com/openshift/csi-operator/pull/473)
* [Full changelog](https://github.com/openshift/csi-operator/compare/37623b14e0e0ba3b69430523a137105140470fe9...878ef6cbe06fabf3cb82ad0ca1c1226e03dfef91)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/0576db3156d4e371a7255f3b19a883c9d2f05b24)

* [OCPBUGS-65763](https://issues.redhat.com/browse/OCPBUGS-65763): continue to update 02_storage.json using new property storageAccountId [#10103](https://github.com/openshift/installer/pull/10103)
* [OCPBUGS-66257](https://issues.redhat.com/browse/OCPBUGS-66257): CORS-4249: bump ARO marketplace images [#10142](https://github.com/openshift/installer/pull/10142)
* [OCPBUGS-66207](https://issues.redhat.com/browse/OCPBUGS-66207), [OCPBUGS-66208](https://issues.redhat.com/browse/OCPBUGS-66208): Fix console info for interactive agent installer [#10136](https://github.com/openshift/installer/pull/10136)
* [Full changelog](https://github.com/openshift/installer/compare/5b017f5fa073c7979416a3ce02715e34d2213da6...0576db3156d4e371a7255f3b19a883c9d2f05b24)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/0e03b7a0fa39e7da3a4b5a180915adc44c408d08)

* [OCPBUGS-65798](https://issues.redhat.com/browse/OCPBUGS-65798): ccoctl azure: retry custom role creation on consistency errors [#948](https://github.com/openshift/cloud-credential-operator/pull/948)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/2705356171a176e09e809b7321c842da01af7403...0e03b7a0fa39e7da3a4b5a180915adc44c408d08)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/fb1a9ab21d72903f79a45f916c6443c0709b9b0c)

* [OCPBUGS-66315](https://issues.redhat.com/browse/OCPBUGS-66315): externaloidc: return errors when node statuses cannot be used to determine oidc state [#814](https://github.com/openshift/cluster-authentication-operator/pull/814)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/6b4cf65c2b56f8cae93032091f33c72c3f7e2f12...fb1a9ab21d72903f79a45f916c6443c0709b9b0c)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/aaf5a61941b70a3b5792c0541e97356565c9977f)

* [OCPBUGS-63675](https://issues.redhat.com/browse/OCPBUGS-63675): update node info processors to include unschedulable nodes [#391](https://github.com/openshift/kubernetes-autoscaler/pull/391)
* [OCPBUGS-63495](https://issues.redhat.com/browse/OCPBUGS-63495): refactor cloud provider options [#387](https://github.com/openshift/kubernetes-autoscaler/pull/387)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/d883d0e6dbb74f0839631ebc7a584669f0e955a3...aaf5a61941b70a3b5792c0541e97356565c9977f)


### [cluster-config-api](https://github.com/openshift/api/tree/1cb53e34ca33d020c765093c21c9b7f4502cbea7)

* [OCPBUGS-66204](https://issues.redhat.com/browse/OCPBUGS-66204): Introduce ClosedClientConnectionPolicy to IngressController API [#2609](https://github.com/openshift/api/pull/2609)
* [OCPBUGS-66135](https://issues.redhat.com/browse/OCPBUGS-66135): Add HTTPKeepAliveTimeout to IngressController API [#2607](https://github.com/openshift/api/pull/2607)
* [Full changelog](https://github.com/openshift/api/compare/1886180ef4300f41168c2d498e0acecd02fa2a48...1cb53e34ca33d020c765093c21c9b7f4502cbea7)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/c706661bce28d9f2beb0c1c0037f1481160db396)

* [OCPBUGS-63677](https://issues.redhat.com/browse/OCPBUGS-63677): Backport 1504 1514 release.420 [#1516](https://github.com/openshift/cluster-etcd-operator/pull/1516)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/0d7067cb286ad4efad5cad9bcff17656ef9827a3...c706661bce28d9f2beb0c1c0037f1481160db396)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/21bea5b51e3729694c91343b130da3b0d36da230)

* [OCPBUGS-65664](https://issues.redhat.com/browse/OCPBUGS-65664): IngressOperator not exposing some metrics for degraded… [#1305](https://github.com/openshift/cluster-ingress-operator/pull/1305)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/2371120eedb27049160c70859ef9972a7599c7e3...21bea5b51e3729694c91343b130da3b0d36da230)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/c49c5e776b44dbac0dcba4897ca0ce803928693e)

* [OCPBUGS-66164](https://issues.redhat.com/browse/OCPBUGS-66164): [release-4.20] CORENET-6465: Remove unneeded logging config from managed ovn-kubernetes [#2838](https://github.com/openshift/cluster-network-operator/pull/2838)
* [OCPBUGS-66162](https://issues.redhat.com/browse/OCPBUGS-66162): [release-4.20] CORENET-6488: Preserve custom resource requests on ovn-control-plane pods [#2835](https://github.com/openshift/cluster-network-operator/pull/2835)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/45843d223ceaea458879da3ee58d89ce1863230b...c49c5e776b44dbac0dcba4897ca0ce803928693e)


### [console](https://github.com/openshift/console/tree/77175da338f4d424063647c8eea0612248f1c801)

* [OCPBUGS-66248](https://issues.redhat.com/browse/OCPBUGS-66248): The number of Quick Starts item is wrong [#15797](https://github.com/openshift/console/pull/15797)
* [OCPBUGS-66206](https://issues.redhat.com/browse/OCPBUGS-66206): Sync YAML editor modal settings [#15787](https://github.com/openshift/console/pull/15787)
* [OCPBUGS-65900](https://issues.redhat.com/browse/OCPBUGS-65900): Fix unnecessary rerenders with pod-connect [#15758](https://github.com/openshift/console/pull/15758)
* [OCPBUGS-61785](https://issues.redhat.com/browse/OCPBUGS-61785): Add validation and type guards on healthHandler calls to prevent errors [#15500](https://github.com/openshift/console/pull/15500)
* [OCPBUGS-65793](https://issues.redhat.com/browse/OCPBUGS-65793): OpenShift Console can only show user name instead of full name as the display name [#15743](https://github.com/openshift/console/pull/15743)
* [OCPBUGS-65949](https://issues.redhat.com/browse/OCPBUGS-65949): Add SDK-webpack 4.20 changelogs [#15768](https://github.com/openshift/console/pull/15768)
* NO-JIRA: Add SDK 4.20 changelogs [#15765](https://github.com/openshift/console/pull/15765)
* [OCPBUGS-65761](https://issues.redhat.com/browse/OCPBUGS-65761): Preserve query string in perspective switch + remove dev console folks from `reviewers` [#15740](https://github.com/openshift/console/pull/15740)
* [Full changelog](https://github.com/openshift/console/compare/9322fe5fadd688acad44acb4e1dfbf408359d4c3...77175da338f4d424063647c8eea0612248f1c801)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/2a7ef4adf7d3074804e6666221bc7c73c2c89ca1)

* [OCPBUGS-65551](https://issues.redhat.com/browse/OCPBUGS-65551): Bump 1.33.6 [#2518](https://github.com/openshift/kubernetes/pull/2518)
* [Full changelog](https://github.com/openshift/kubernetes/compare/4c392f99fc20a9a5407d8e640c557a47efc7dae2...2a7ef4adf7d3074804e6666221bc7c73c2c89ca1)


### [hypershift](https://github.com/openshift/hypershift/tree/a5aab25bedac7d53d90415cf08490acb6d0d7052)

* [CNTRLPLANE-1710](https://issues.redhat.com/browse/CNTRLPLANE-1710): feat(globalps): security enhancements on GlobalPullSecret feature [#7234](https://github.com/openshift/hypershift/pull/7234)
* [Full changelog](https://github.com/openshift/hypershift/compare/a7379d4c18a2cd0b8efcd646cbce13f33c45e025...a5aab25bedac7d53d90415cf08490acb6d0d7052)


### [insights-operator](https://github.com/openshift/insights-operator/tree/d677651537715900907eec88e6f0537c8c94c6e9)

* [OCPBUGS-66062](https://issues.redhat.com/browse/OCPBUGS-66062): Add filtering to add other possible pod status to QEMU gatherer [#1185](https://github.com/openshift/insights-operator/pull/1185)
* [OCPBUGS-64800](https://issues.redhat.com/browse/OCPBUGS-64800): QEMU logs are not gathered if there are pending status virt-launcher pods [#1174](https://github.com/openshift/insights-operator/pull/1174)
* [Full changelog](https://github.com/openshift/insights-operator/compare/90a727f7f59f8ea095f17ff17d8d411fb099c63e...d677651537715900907eec88e6f0537c8c94c6e9)


### [ironic](https://github.com/openshift/ironic-image/tree/1821ac0208c0af8decbfb5aa077b793b7222d102)

* [METAL-1695](https://issues.redhat.com/browse/METAL-1695): OKD: install Ironic from the OpenShift fork [#740](https://github.com/openshift/ironic-image/pull/740)
* [OKD-304](https://issues.redhat.com/browse/OKD-304): Fix python dependencies for OKD [#731](https://github.com/openshift/ironic-image/pull/731)
* [Full changelog](https://github.com/openshift/ironic-image/compare/fb4eeefe7f6419446a8d5ae717b9e3baf129b07b...1821ac0208c0af8decbfb5aa077b793b7222d102)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/f29e5b702153ecd51ee75cf7b55426075888d7e4)

* [OCPBUGS-66084](https://issues.redhat.com/browse/OCPBUGS-66084), [OKD-295](https://issues.redhat.com/browse/OKD-295): Fix broken OKD ironic-agent-image [#216](https://github.com/openshift/ironic-agent-image/pull/216)
* [OCPBUGS-65519](https://issues.redhat.com/browse/OCPBUGS-65519): Include Test advertised ip reachability before assigning it [#212](https://github.com/openshift/ironic-agent-image/pull/212)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/ce01f3c1ed6022f9eecc164b2ae34aec25b3dee4...f29e5b702153ecd51ee75cf7b55426075888d7e4)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/2a29ea49e2625aac5e66e9675de04c2677689c7c)

* [OKD-294](https://issues.redhat.com/browse/OKD-294): Migrate runtime from runc to crun on an upgrade for OKD [#5467](https://github.com/openshift/machine-config-operator/pull/5467)
* [OCPBUGS-65898](https://issues.redhat.com/browse/OCPBUGS-65898): fixes systemd unit creation for empty units [#5437](https://github.com/openshift/machine-config-operator/pull/5437)
* [OCPBUGS-64822](https://issues.redhat.com/browse/OCPBUGS-64822): block upgrades for conflict  non-default ClusterImagePolicy resources [#5414](https://github.com/openshift/machine-config-operator/pull/5414)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/0a8e1230d454fb7d72f54bf9065db3a4769b9a86...2a29ea49e2625aac5e66e9675de04c2677689c7c)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/8de67446fade49119c06c1d7c00f9f2b62518b77)

* [OCPBUGS-66240](https://issues.redhat.com/browse/OCPBUGS-66240): configure max TLS version only when specified [#664](https://github.com/openshift/monitoring-plugin/pull/664)
* [OCPBUGS-65947](https://issues.redhat.com/browse/OCPBUGS-65947): add missing conversion units [#654](https://github.com/openshift/monitoring-plugin/pull/654)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/c6a042a64369147cf997e5e794b89e577a3c3532...8de67446fade49119c06c1d7c00f9f2b62518b77)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/619d169136e369b1d8d1f48f598ab713bac6b4bb)

* [OCPBUGS-66335](https://issues.redhat.com/browse/OCPBUGS-66335): fix flickerying in synced editor [#304](https://github.com/openshift/networking-console-plugin/pull/304)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/565fb2242d62dae518820cda104685a843c78f95...619d169136e369b1d8d1f48f598ab713bac6b4bb)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/f4775a263f2ddbc9f94c9349231883614dce0193)

* [OCPBUGS-64647](https://issues.redhat.com/browse/OCPBUGS-64647): fix: return only requested version [#1306](https://github.com/openshift/oc-mirror/pull/1306)
* [OCPBUGS-65787](https://issues.redhat.com/browse/OCPBUGS-65787): Remove empty status field from generated IDMS/ITMS files [#1313](https://github.com/openshift/oc-mirror/pull/1313)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/b598121bb70555120dde8d60fa9fbcde4f7b3d65...f4775a263f2ddbc9f94c9349231883614dce0193)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/34cb4762e1716c1a31a344118b8a3ad00c28d831)

* [OCPBUGS-65848](https://issues.redhat.com/browse/OCPBUGS-65848): Add ValidatingAdmissionPolicy and check for omissions next time. [#577](https://github.com/openshift/openshift-apiserver/pull/577)
* [OCPBUGS-61982](https://issues.redhat.com/browse/OCPBUGS-61982): pkg/image: conditionally parse raw image manifest [#559](https://github.com/openshift/openshift-apiserver/pull/559)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/1a249ce37792c7f85a47a3cacf658268a1780b5c...34cb4762e1716c1a31a344118b8a3ad00c28d831)


### [operator-marketplace](https://github.com/operator-framework/operator-marketplace/tree/e88619ea60753b276b2d813e050d8cfbbfce5a41)

* [OCPBUGS-65680](https://issues.redhat.com/browse/OCPBUGS-65680): enforce client side auth requirement for metrics endpoint [#688](https://github.com/operator-framework/operator-marketplace/pull/688)
* [Full changelog](https://github.com/operator-framework/operator-marketplace/compare/c6abd3acc6af77a7f117bd89cececfae8c4830b1...e88619ea60753b276b2d813e050d8cfbbfce5a41)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/6c78b6defbd606f8fdf002d7cc37e3d49c7bcd98)

* [OCPBUGS-64836](https://issues.redhat.com/browse/OCPBUGS-64836): back-port IP & MAC conflict detection [#2827](https://github.com/openshift/ovn-kubernetes/pull/2827)
* [OCPBUGS-65514](https://issues.redhat.com/browse/OCPBUGS-65514): [4.20] status manager: remove managedFields for deleted zone upon zone deletion [#2855](https://github.com/openshift/ovn-kubernetes/pull/2855)
* [OCPBUGS-65951](https://issues.redhat.com/browse/OCPBUGS-65951): [release-4.20]: Fix linter issues, add missing cheryy-pick bits of #2844 [#2866](https://github.com/openshift/ovn-kubernetes/pull/2866)
* [OCPBUGS-65618](https://issues.redhat.com/browse/OCPBUGS-65618): [release-4.20] OCP4: 4.18.22 EgressIP Failover does not succeed - extended downtime and no reassignment between egress-capable peers [#2865](https://github.com/openshift/ovn-kubernetes/pull/2865)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/0f330d1959be2f19f88a0df27889a7cdac0224b0...6c78b6defbd606f8fdf002d7cc37e3d49c7bcd98)


### [tests](https://github.com/openshift/origin/tree/11e5d68ef2da023d9add4aaf2feaff48c350e11a)

* [OCPNODE-3912](https://issues.redhat.com/browse/OCPNODE-3912): Add a test for NodeSizing default change to OCP 4.20 [#30467](https://github.com/openshift/origin/pull/30467)
* [OCPBUGS-64777](https://issues.redhat.com/browse/OCPBUGS-64777): [release-4.20] Add e2e tests for storage network policy [#30468](https://github.com/openshift/origin/pull/30468)
* [Full changelog](https://github.com/openshift/origin/compare/0a0905d0324e700bec50544fc3a0d4878a430b20...11e5d68ef2da023d9add4aaf2feaff48c350e11a)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/a417b217d7f39b02ba0bc1b75aa3bf52602df189)

* [OCPBUGS-65795](https://issues.redhat.com/browse/OCPBUGS-65795): Fixed logic for vSphere compute cluster permission [#197](https://github.com/openshift/vsphere-problem-detector/pull/197)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/9d55c028b27bc63c687342f0b7172ce39e07ec5a...a417b217d7f39b02ba0bc1b75aa3bf52602df189)