# 4.20.0-okd-scos.8

Created: 2025-11-10 05:30:33 +0000 UTC

Image Digest: `sha256:2b69eb4e3c7110bd4dff8dfa66bc79436b549829adc59602ac8f8f83b82749d1`

Promoted from registry.ci.openshift.org/origin/release-scos:4.20.0-0.okd-scos-2025-11-09-100633


## Changes from 4.20.0-okd-scos.6

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.5
* Kubernetes Tests 1.33.4
* CentOS Stream CoreOS 10.0.20251023-0


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/4b116f46ca39a4933cab5647e5db44432c752b80)

* [OCPBUGS-63486](https://issues.redhat.com/browse/OCPBUGS-63486): Align kube descheduler activation CR with OVE needs [#8136](https://github.com/openshift/assisted-service/pull/8136)
* [Full changelog](https://github.com/openshift/assisted-service/compare/c616cdc940cf15bc911d0228e589d931c5a741d3...4b116f46ca39a4933cab5647e5db44432c752b80)


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/f567fb90bcd80834d18cee39ff1d135f6d6dbc50)

* [OCPBUGS-64694](https://issues.redhat.com/browse/OCPBUGS-64694): Update 4.20 version to 4.20.2 [#193](https://github.com/openshift/agent-installer-utils/pull/193)
* [OCPBUGS-63585](https://issues.redhat.com/browse/OCPBUGS-63585): AGENT-1203: Simplify isobuilder [#189](https://github.com/openshift/agent-installer-utils/pull/189)
* [OCPBUGS-63590](https://issues.redhat.com/browse/OCPBUGS-63590): Update 4.20 version to 4.20.1 [#190](https://github.com/openshift/agent-installer-utils/pull/190)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/11ced42a5369c0e78de202cf261c8c4db3eb7911...f567fb90bcd80834d18cee39ff1d135f6d6dbc50)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/dc35256d52e1ff30cd49f3c6649b5eca370ce03c)

* [OCPBUGS-63560](https://issues.redhat.com/browse/OCPBUGS-63560): Add RBAC ClusterRole and Binding for driver node [#456](https://github.com/openshift/csi-operator/pull/456)
* [Full changelog](https://github.com/openshift/csi-operator/compare/aaed46b82068ec95f4de716c9e7c09174cfee582...dc35256d52e1ff30cd49f3c6649b5eca370ce03c)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/b1cb6432a0ae47248e126d32fb6012eb1408e833)

* [OCPBUGS-63535](https://issues.redhat.com/browse/OCPBUGS-63535): Support DataDisks on Azure Stack Hub [#165](https://github.com/openshift/machine-api-provider-azure/pull/165)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/4927cc2be4f629e367d2a79a310900c7cced3f6c...b1cb6432a0ae47248e126d32fb6012eb1408e833)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/200070b922dcf6bfd4819d7063f13e14ea296241)

* [OCPBUGS-63633](https://issues.redhat.com/browse/OCPBUGS-63633): Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 [#10037](https://github.com/openshift/installer/pull/10037)
* [Full changelog](https://github.com/openshift/installer/compare/cbd9f67f1260b158294f7dd16a87863c139702cb...200070b922dcf6bfd4819d7063f13e14ea296241)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/0581d703b56b153b941022bca4ce3c34de576f3c)

* [OCPBUGS-64791](https://issues.redhat.com/browse/OCPBUGS-64791): Rely on overall available disk space of the mounted volume [#2133](https://github.com/openshift/oc/pull/2133)
* [OCPBUGS-64773](https://issues.redhat.com/browse/OCPBUGS-64773): oc adm must-gather: Wrap gather in a session [#2132](https://github.com/openshift/oc/pull/2132)
* [Full changelog](https://github.com/openshift/oc/compare/7f1d6f88cb0c8ed5c877fc0ae2bd99298c6339f2...0581d703b56b153b941022bca4ce3c34de576f3c)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/17948f42adc4fce592908d48730f45d665bcbbba)

* [OCPBUGS-63546](https://issues.redhat.com/browse/OCPBUGS-63546): ccoctl: add public-key-file flag to create-all [#936](https://github.com/openshift/cloud-credential-operator/pull/936)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/d391c0b339c48f49711ccff9ebac62039bf5c6f7...17948f42adc4fce592908d48730f45d665bcbbba)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)

* [OCPBUGS-63542](https://issues.redhat.com/browse/OCPBUGS-63542): Change the capacity struct from int to ptrOfInt [#185](https://github.com/openshift/cloud-network-config-controller/pull/185)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/467e50feff5a56afbf9ccefc025781c9ccff8eca...a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/c9067c2a4902b0afeb3b288c4ff56fa381a1d1e0)

* [OCPBUGS-63319](https://issues.redhat.com/browse/OCPBUGS-63319): (bugfix): configure status controller to remove unset versions [#802](https://github.com/openshift/cluster-authentication-operator/pull/802)
* [OCPBUGS-64668](https://issues.redhat.com/browse/OCPBUGS-64668): Update OIDC e2e test to expect admission-time validation error of invalid CEL expression [#804](https://github.com/openshift/cluster-authentication-operator/pull/804)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/11e57aa35590d3481288e09003c9109e0bfc62ce...c9067c2a4902b0afeb3b288c4ff56fa381a1d1e0)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/276696ccf679830b25df341edb7aae9bb3f4e763)

* [OCPBUGS-63164](https://issues.redhat.com/browse/OCPBUGS-63164): ccm: disable unused secure-serving port and webhook [#419](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/419)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/e355ad389d1d09be1a83f024f54b15e844982d0a...276696ccf679830b25df341edb7aae9bb3f4e763)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/263f18b6c9eb82e4aabf586093b2cc711e674e77)

* [OCPBUGS-64689](https://issues.redhat.com/browse/OCPBUGS-64689): Add priority field to prevent early shutdown [#1955](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1955)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/cae310f190fccb3f0fa613de50c484afb039c098...263f18b6c9eb82e4aabf586093b2cc711e674e77)


### [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator/tree/234e218207ec963df04ec1fedad85a421eb7a1ff)

* [OCPBUGS-63173](https://issues.redhat.com/browse/OCPBUGS-63173): Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.20 [#62](https://github.com/openshift/cluster-api-operator/pull/62)
* [Full changelog](https://github.com/openshift/cluster-api-operator/compare/3ec30377ffff951dc9c0fc2257d290e4b4958465...234e218207ec963df04ec1fedad85a421eb7a1ff)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/438c9dba80ddadeabe9efe4a654297a7b550b2b8)

* [OCPBUGS-64684](https://issues.redhat.com/browse/OCPBUGS-64684): Add priority field to prevent early shutdown [#890](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/890)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/5a7da72ce2d21fc0900b428334865d97f39f6037...438c9dba80ddadeabe9efe4a654297a7b550b2b8)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/b3c82b2eec66ae3ae510df0603af1212c34be618)

* [OCPBUGS-63587](https://issues.redhat.com/browse/OCPBUGS-63587): port 9193 need to be internal and port 9194 need to have a service [#280](https://github.com/openshift/cluster-machine-approver/pull/280)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/ce2750589129dd20b3d1b6a5e7bb8c392d658c5c...b3c82b2eec66ae3ae510df0603af1212c34be618)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/870b44fc269ae4e790a3487d1795880d93ff72a9)

* [OCPBUGS-62978](https://issues.redhat.com/browse/OCPBUGS-62978): add tls configuration for the monitoring plugin deployment [#2718](https://github.com/openshift/cluster-monitoring-operator/pull/2718)
* [OCPBUGS-62829](https://issues.redhat.com/browse/OCPBUGS-62829): Remove cluster from non-multicluster dashboards [#2701](https://github.com/openshift/cluster-monitoring-operator/pull/2701)
* [OCPBUGS-64577](https://issues.redhat.com/browse/OCPBUGS-64577): Fix KSM deny-list typo [#2729](https://github.com/openshift/cluster-monitoring-operator/pull/2729)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/c2dfaad07a7098d4b88df54d88fa2b77f18df52b...870b44fc269ae4e790a3487d1795880d93ff72a9)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/1666a71c205071b6d44bfa57c0ebd3f0054fa1cd)

* [OCPBUGS-64733](https://issues.redhat.com/browse/OCPBUGS-64733): api, l2udn: subnets must be masked [#2823](https://github.com/openshift/cluster-network-operator/pull/2823)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/b0393aa3e67302d89e91b8f7b1013b6d2e317f04...1666a71c205071b6d44bfa57c0ebd3f0054fa1cd)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/2ed182ba57106a7c8cc727aa003e46be079b7dd9)

* [OCPBUGS-63010](https://issues.redhat.com/browse/OCPBUGS-63010): E2E: Add test cases related to schedulable control plane nodes [#1409](https://github.com/openshift/cluster-node-tuning-operator/pull/1409)
* [OCPBUGS-62889](https://issues.redhat.com/browse/OCPBUGS-62889): E2E: llc: make sure to remove any trailing newspaces [#1408](https://github.com/openshift/cluster-node-tuning-operator/pull/1408)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/2bcf9f0303ea6a77813f7f1c79d91cd3b67c2860...2ed182ba57106a7c8cc727aa003e46be079b7dd9)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/b343f70f19ffd559e1a81d3a3e65bd106e634c13)

* [OCPBUGS-63507](https://issues.redhat.com/browse/OCPBUGS-63507): references to github.com/sclorg/django-ex.git now also refer to the branch [#655](https://github.com/openshift/cluster-samples-operator/pull/655)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/62b3623c6a2860e7a8cc368dbe76e767508cd261...b343f70f19ffd559e1a81d3a3e65bd106e634c13)


### [console](https://github.com/openshift/console/tree/d568950eaea74c15da2c3e5a89d95fcc0b5cc90a)

* [OCPBUGS-63616](https://issues.redhat.com/browse/OCPBUGS-63616): Preserve path on perspective switch [#15650](https://github.com/openshift/console/pull/15650)
* [OCPBUGS-64809](https://issues.redhat.com/browse/OCPBUGS-64809): Never allow OTHER_CATEGORY in categories [#15690](https://github.com/openshift/console/pull/15690)
* [OCPBUGS-63608](https://issues.redhat.com/browse/OCPBUGS-63608): Fix catalog search relevance scoring, so that operators with attribute.keywords are displayed and remove unnecessary metadataName from calculation [#15648](https://github.com/openshift/console/pull/15648)
* [OCPBUGS-63470](https://issues.redhat.com/browse/OCPBUGS-63470): limit node log length to 1000 lines [#15635](https://github.com/openshift/console/pull/15635)
* [Full changelog](https://github.com/openshift/console/compare/712584257c2fb5b9b060a5e49ce44591cb4363de...d568950eaea74c15da2c3e5a89d95fcc0b5cc90a)


### [console-operator](https://github.com/openshift/console-operator/tree/cdbc995ad9906b20a6048630d5d8af285bad7cc5)

* [OCPBUGS-64602](https://issues.redhat.com/browse/OCPBUGS-64602): Remove v1alpha1 ConsolePlugin version from CRDs status [#1060](https://github.com/openshift/console-operator/pull/1060)
* [Full changelog](https://github.com/openshift/console-operator/compare/5e127e5f49c56b47914e2ba4aedb09e99b165800...cdbc995ad9906b20a6048630d5d8af285bad7cc5)


### [etcd, installer-etcd-artifacts](https://github.com/openshift/etcd/tree/eac09c01677bb03daed156d407be27785fd61e0d)

* [OCPBUGS-63474](https://issues.redhat.com/browse/OCPBUGS-63474): 4.20 rebase 3.5.24 [#347](https://github.com/openshift/etcd/pull/347)
* [Full changelog](https://github.com/openshift/etcd/compare/9c065d4d842c8de57806426c13201413b4d595e2...eac09c01677bb03daed156d407be27785fd61e0d)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/cf396bff09dcb68a96f718b5e0e80b50e874afb5)

* NO-JIRA: enable CBOR tests [#2502](https://github.com/openshift/kubernetes/pull/2502)
* [OCPBUGS-63601](https://issues.redhat.com/browse/OCPBUGS-63601): UPSTREAM: <carry>: Skip CPU resource status for workload-partitioning [#2504](https://github.com/openshift/kubernetes/pull/2504)
* [Full changelog](https://github.com/openshift/kubernetes/compare/e0d42164c84ee27644b85a1d2c9bbb062066056d...cf396bff09dcb68a96f718b5e0e80b50e874afb5)


### [hypershift](https://github.com/openshift/hypershift/tree/73e8a0ef65aa019bad67eae70987f5ca71edda52)

* [OCPBUGS-63718](https://issues.redhat.com/browse/OCPBUGS-63718): specify SCC annotation for pods in data plane [#7132](https://github.com/openshift/hypershift/pull/7132)
* [OCPBUGS-63128](https://issues.redhat.com/browse/OCPBUGS-63128): resolve initContainer permission issue after node reboot [#7080](https://github.com/openshift/hypershift/pull/7080)
* [OCPBUGS-63604](https://issues.redhat.com/browse/OCPBUGS-63604): fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries [#7107](https://github.com/openshift/hypershift/pull/7107)
* [OCPBUGS-63367](https://issues.redhat.com/browse/OCPBUGS-63367): FIPS compliant hypershift binary [#7083](https://github.com/openshift/hypershift/pull/7083)
* [Full changelog](https://github.com/openshift/hypershift/compare/0e15c389eeafd816549bcda092124105a762f7d1...73e8a0ef65aa019bad67eae70987f5ca71edda52)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/b9dbf396412a463e6828332ce28a2ff514424e9e)

* [OCPBUGS-64656](https://issues.redhat.com/browse/OCPBUGS-64656): Update the OCP base image in Dockerfile to 4.20 reference [#5392](https://github.com/openshift/machine-config-operator/pull/5392)
* [OCPBUGS-63534](https://issues.redhat.com/browse/OCPBUGS-63534): Create temporal allow policy [#5373](https://github.com/openshift/machine-config-operator/pull/5373)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/d239f7a5eacf418d8333d021dc02abe3ec176ace...b9dbf396412a463e6828332ce28a2ff514424e9e)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/c6a042a64369147cf997e5e794b89e577a3c3532)

* [OCPBUGS-63440](https://issues.redhat.com/browse/OCPBUGS-63440): fetch metric labels with tenancy [#617](https://github.com/openshift/monitoring-plugin/pull/617)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/736cb4836b5b86c2fcf9aed4e87d3f528d6f9246...c6a042a64369147cf997e5e794b89e577a3c3532)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/9de315953ad1b357c35003937a1a2f27aa9068e0)

* Hide VirtualMachine networks page in 4.20 release [#290](https://github.com/openshift/networking-console-plugin/pull/290)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f09c58b909fd6479e0099f7962ef73b70e280685...9de315953ad1b357c35003937a1a2f27aa9068e0)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/b598121bb70555120dde8d60fa9fbcde4f7b3d65)

* [OCPBUGS-63030](https://issues.redhat.com/browse/OCPBUGS-63030): removes unintended exec permissions [#1291](https://github.com/openshift/oc-mirror/pull/1291)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/b51b46d4d6000054d1a11568b3302f709a28bdde...b598121bb70555120dde8d60fa9fbcde4f7b3d65)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/c7e12ae3e00d8fdc6744815370e450bcc68c0dac)

* [OCPBUGS-64590](https://issues.redhat.com/browse/OCPBUGS-64590): NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated [#2841](https://github.com/openshift/ovn-kubernetes/pull/2841)
* [OCPBUGS-63696](https://issues.redhat.com/browse/OCPBUGS-63696): Fixes OF flows to be VLAN aware as well as add DPU checks for certain features [#2837](https://github.com/openshift/ovn-kubernetes/pull/2837)
* [OCPBUGS-63007](https://issues.redhat.com/browse/OCPBUGS-63007): kubevirt: fix bad release of IPs of live migratable pods [#2801](https://github.com/openshift/ovn-kubernetes/pull/2801)
* [OCPBUGS-63577](https://issues.redhat.com/browse/OCPBUGS-63577): [release-4.20] CORENET-6055: Dockerfile: Unpin OVN and consume the latest from FDP. [#2808](https://github.com/openshift/ovn-kubernetes/pull/2808)
* [OCPBUGS-63631](https://issues.redhat.com/browse/OCPBUGS-63631): Skip Pending pods in EgressIP status updates [#2831](https://github.com/openshift/ovn-kubernetes/pull/2831)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/050ed2c215b55aef456c73c5217427600756ae75...c7e12ae3e00d8fdc6744815370e450bcc68c0dac)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/fa749d65d8eca1cc937554baab91385a78ec8ce1)

* [OCPBUGS-63624](https://issues.redhat.com/browse/OCPBUGS-63624): bump github.com/prometheus/procfs to v0.16.1 [#173](https://github.com/openshift/node_exporter/pull/173)
* [Full changelog](https://github.com/openshift/node_exporter/compare/56f6158e797ab80e5e0da2cb0ba701cb02902ef7...fa749d65d8eca1cc937554baab91385a78ec8ce1)


### [tests](https://github.com/openshift/origin/tree/b4a97e59b086e20d856d2fca30e27cbf994ed4a8)

* [OCPBUGS-64598](https://issues.redhat.com/browse/OCPBUGS-64598): Updated the upgrade duration limit to 100 minutes for ppc64le [#30451](https://github.com/openshift/origin/pull/30451)
* [OCPBUGS-64593](https://issues.redhat.com/browse/OCPBUGS-64593): [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support [#30415](https://github.com/openshift/origin/pull/30415)
* [OCPBUGS-63725](https://issues.redhat.com/browse/OCPBUGS-63725): CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift [#30439](https://github.com/openshift/origin/pull/30439)
* [OCPBUGS-63171](https://issues.redhat.com/browse/OCPBUGS-63171): Add imagestream update dryrun test [#30389](https://github.com/openshift/origin/pull/30389)
* [OCPBUGS-63513](https://issues.redhat.com/browse/OCPBUGS-63513): Migrate OCP-32383 to upstream [#30423](https://github.com/openshift/origin/pull/30423)
* [Full changelog](https://github.com/openshift/origin/compare/30f0ace4f4f3fc575a05c253e8893e92d2a68404...b4a97e59b086e20d856d2fca30e27cbf994ed4a8)