# 4.20.0-okd-scos.8

Created: 2025-11-10 05:30:33 +0000 UTC

Image Digest: `sha256:2b69eb4e3c7110bd4dff8dfa66bc79436b549829adc59602ac8f8f83b82749d1`

Promoted from registry.ci.openshift.org/origin/release-scos:4.20.0-0.okd-scos-2025-11-09-100633


## Changes from 4.20.0-okd-scos.7

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.5
* Kubernetes Tests 1.33.4
* CentOS Stream CoreOS 10.0.20251023-0


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/f567fb90bcd80834d18cee39ff1d135f6d6dbc50)

* [OCPBUGS-64694](https://issues.redhat.com/browse/OCPBUGS-64694): Update 4.20 version to 4.20.2 [#193](https://github.com/openshift/agent-installer-utils/pull/193)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/6d64a0891291701aa0b38b57c8ac9cfa81a69fe4...f567fb90bcd80834d18cee39ff1d135f6d6dbc50)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/200070b922dcf6bfd4819d7063f13e14ea296241)

* [OCPBUGS-63633](https://issues.redhat.com/browse/OCPBUGS-63633): Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 [#10037](https://github.com/openshift/installer/pull/10037)
* [Full changelog](https://github.com/openshift/installer/compare/cbd9f67f1260b158294f7dd16a87863c139702cb...200070b922dcf6bfd4819d7063f13e14ea296241)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/0581d703b56b153b941022bca4ce3c34de576f3c)

* [OCPBUGS-64791](https://issues.redhat.com/browse/OCPBUGS-64791): Rely on overall available disk space of the mounted volume [#2133](https://github.com/openshift/oc/pull/2133)
* [OCPBUGS-64773](https://issues.redhat.com/browse/OCPBUGS-64773): oc adm must-gather: Wrap gather in a session [#2132](https://github.com/openshift/oc/pull/2132)
* [Full changelog](https://github.com/openshift/oc/compare/7f1d6f88cb0c8ed5c877fc0ae2bd99298c6339f2...0581d703b56b153b941022bca4ce3c34de576f3c)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/17948f42adc4fce592908d48730f45d665bcbbba)

* [OCPBUGS-63546](https://issues.redhat.com/browse/OCPBUGS-63546): ccoctl: add public-key-file flag to create-all [#936](https://github.com/openshift/cloud-credential-operator/pull/936)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/d391c0b339c48f49711ccff9ebac62039bf5c6f7...17948f42adc4fce592908d48730f45d665bcbbba)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/c9067c2a4902b0afeb3b288c4ff56fa381a1d1e0)

* [OCPBUGS-63319](https://issues.redhat.com/browse/OCPBUGS-63319): (bugfix): configure status controller to remove unset versions [#802](https://github.com/openshift/cluster-authentication-operator/pull/802)
* [OCPBUGS-64668](https://issues.redhat.com/browse/OCPBUGS-64668): Update OIDC e2e test to expect admission-time validation error of invalid CEL expression [#804](https://github.com/openshift/cluster-authentication-operator/pull/804)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/11e57aa35590d3481288e09003c9109e0bfc62ce...c9067c2a4902b0afeb3b288c4ff56fa381a1d1e0)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/263f18b6c9eb82e4aabf586093b2cc711e674e77)

* [OCPBUGS-64689](https://issues.redhat.com/browse/OCPBUGS-64689): Add priority field to prevent early shutdown [#1955](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1955)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/cae310f190fccb3f0fa613de50c484afb039c098...263f18b6c9eb82e4aabf586093b2cc711e674e77)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/438c9dba80ddadeabe9efe4a654297a7b550b2b8)

* [OCPBUGS-64684](https://issues.redhat.com/browse/OCPBUGS-64684): Add priority field to prevent early shutdown [#890](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/890)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/5a7da72ce2d21fc0900b428334865d97f39f6037...438c9dba80ddadeabe9efe4a654297a7b550b2b8)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/870b44fc269ae4e790a3487d1795880d93ff72a9)

* [OCPBUGS-62978](https://issues.redhat.com/browse/OCPBUGS-62978): add tls configuration for the monitoring plugin deployment [#2718](https://github.com/openshift/cluster-monitoring-operator/pull/2718)
* [OCPBUGS-62829](https://issues.redhat.com/browse/OCPBUGS-62829): Remove cluster from non-multicluster dashboards [#2701](https://github.com/openshift/cluster-monitoring-operator/pull/2701)
* [OCPBUGS-64577](https://issues.redhat.com/browse/OCPBUGS-64577): Fix KSM deny-list typo [#2729](https://github.com/openshift/cluster-monitoring-operator/pull/2729)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/c2dfaad07a7098d4b88df54d88fa2b77f18df52b...870b44fc269ae4e790a3487d1795880d93ff72a9)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/1666a71c205071b6d44bfa57c0ebd3f0054fa1cd)

* [OCPBUGS-64733](https://issues.redhat.com/browse/OCPBUGS-64733): api, l2udn: subnets must be masked [#2823](https://github.com/openshift/cluster-network-operator/pull/2823)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/b0393aa3e67302d89e91b8f7b1013b6d2e317f04...1666a71c205071b6d44bfa57c0ebd3f0054fa1cd)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/2ed182ba57106a7c8cc727aa003e46be079b7dd9)

* [OCPBUGS-63010](https://issues.redhat.com/browse/OCPBUGS-63010): E2E: Add test cases related to schedulable control plane nodes [#1409](https://github.com/openshift/cluster-node-tuning-operator/pull/1409)
* [OCPBUGS-62889](https://issues.redhat.com/browse/OCPBUGS-62889): E2E: llc: make sure to remove any trailing newspaces [#1408](https://github.com/openshift/cluster-node-tuning-operator/pull/1408)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/2bcf9f0303ea6a77813f7f1c79d91cd3b67c2860...2ed182ba57106a7c8cc727aa003e46be079b7dd9)


### [console](https://github.com/openshift/console/tree/d568950eaea74c15da2c3e5a89d95fcc0b5cc90a)

* [OCPBUGS-63616](https://issues.redhat.com/browse/OCPBUGS-63616): Preserve path on perspective switch [#15650](https://github.com/openshift/console/pull/15650)
* [OCPBUGS-64809](https://issues.redhat.com/browse/OCPBUGS-64809): Never allow OTHER_CATEGORY in categories [#15690](https://github.com/openshift/console/pull/15690)
* [Full changelog](https://github.com/openshift/console/compare/e58e5b0246b82eb1c4a4a05957c9f6ef9c62ee40...d568950eaea74c15da2c3e5a89d95fcc0b5cc90a)


### [console-operator](https://github.com/openshift/console-operator/tree/cdbc995ad9906b20a6048630d5d8af285bad7cc5)

* [OCPBUGS-64602](https://issues.redhat.com/browse/OCPBUGS-64602): Remove v1alpha1 ConsolePlugin version from CRDs status [#1060](https://github.com/openshift/console-operator/pull/1060)
* [Full changelog](https://github.com/openshift/console-operator/compare/5e127e5f49c56b47914e2ba4aedb09e99b165800...cdbc995ad9906b20a6048630d5d8af285bad7cc5)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/cf396bff09dcb68a96f718b5e0e80b50e874afb5)

* NO-JIRA: enable CBOR tests [#2502](https://github.com/openshift/kubernetes/pull/2502)
* [Full changelog](https://github.com/openshift/kubernetes/compare/debdebd535dc3f5d0ab3557aa79172ff92344d97...cf396bff09dcb68a96f718b5e0e80b50e874afb5)


### [hypershift](https://github.com/openshift/hypershift/tree/73e8a0ef65aa019bad67eae70987f5ca71edda52)

* [OCPBUGS-63718](https://issues.redhat.com/browse/OCPBUGS-63718): specify SCC annotation for pods in data plane [#7132](https://github.com/openshift/hypershift/pull/7132)
* [Full changelog](https://github.com/openshift/hypershift/compare/a28b548128e1963b2e4166268471957a3457f70b...73e8a0ef65aa019bad67eae70987f5ca71edda52)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/b9dbf396412a463e6828332ce28a2ff514424e9e)

* [OCPBUGS-64656](https://issues.redhat.com/browse/OCPBUGS-64656): Update the OCP base image in Dockerfile to 4.20 reference [#5392](https://github.com/openshift/machine-config-operator/pull/5392)
* [OCPBUGS-63534](https://issues.redhat.com/browse/OCPBUGS-63534): Create temporal allow policy [#5373](https://github.com/openshift/machine-config-operator/pull/5373)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/d239f7a5eacf418d8333d021dc02abe3ec176ace...b9dbf396412a463e6828332ce28a2ff514424e9e)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/b598121bb70555120dde8d60fa9fbcde4f7b3d65)

* [OCPBUGS-63030](https://issues.redhat.com/browse/OCPBUGS-63030): removes unintended exec permissions [#1291](https://github.com/openshift/oc-mirror/pull/1291)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/b51b46d4d6000054d1a11568b3302f709a28bdde...b598121bb70555120dde8d60fa9fbcde4f7b3d65)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/c7e12ae3e00d8fdc6744815370e450bcc68c0dac)

* [OCPBUGS-64590](https://issues.redhat.com/browse/OCPBUGS-64590): NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated [#2841](https://github.com/openshift/ovn-kubernetes/pull/2841)
* [OCPBUGS-63696](https://issues.redhat.com/browse/OCPBUGS-63696): Fixes OF flows to be VLAN aware as well as add DPU checks for certain features [#2837](https://github.com/openshift/ovn-kubernetes/pull/2837)
* [OCPBUGS-63007](https://issues.redhat.com/browse/OCPBUGS-63007): kubevirt: fix bad release of IPs of live migratable pods [#2801](https://github.com/openshift/ovn-kubernetes/pull/2801)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/962c36bae07e5c0c6a4b3f92770956788bfc296c...c7e12ae3e00d8fdc6744815370e450bcc68c0dac)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/fa749d65d8eca1cc937554baab91385a78ec8ce1)

* [OCPBUGS-63624](https://issues.redhat.com/browse/OCPBUGS-63624): bump github.com/prometheus/procfs to v0.16.1 [#173](https://github.com/openshift/node_exporter/pull/173)
* [Full changelog](https://github.com/openshift/node_exporter/compare/56f6158e797ab80e5e0da2cb0ba701cb02902ef7...fa749d65d8eca1cc937554baab91385a78ec8ce1)


### [tests](https://github.com/openshift/origin/tree/b4a97e59b086e20d856d2fca30e27cbf994ed4a8)

* [OCPBUGS-64598](https://issues.redhat.com/browse/OCPBUGS-64598): Updated the upgrade duration limit to 100 minutes for ppc64le [#30451](https://github.com/openshift/origin/pull/30451)
* [OCPBUGS-64593](https://issues.redhat.com/browse/OCPBUGS-64593): [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support [#30415](https://github.com/openshift/origin/pull/30415)
* [OCPBUGS-63725](https://issues.redhat.com/browse/OCPBUGS-63725): CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift [#30439](https://github.com/openshift/origin/pull/30439)
* [OCPBUGS-63171](https://issues.redhat.com/browse/OCPBUGS-63171): Add imagestream update dryrun test [#30389](https://github.com/openshift/origin/pull/30389)
* [Full changelog](https://github.com/openshift/origin/compare/0904319ce359e01cff4a86e26e7786f7cfae4d2a...b4a97e59b086e20d856d2fca30e27cbf994ed4a8)