# 4.20.0-okd-scos.3

Created: 2025-10-06 05:30:40 +0000 UTC

Image Digest: `sha256:755be8fb9eb73a8f7916dfbf86aa99971df42afbc174e57a8f60745aa8ab4d9e`

Promoted from registry.ci.openshift.org/origin/release-scos:4.20.0-0.okd-scos-2025-10-04-050521


## Changes from 4.20.0-okd-scos.ec.16

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.4
* Kubernetes Tests 1.33.3
* CentOS Stream CoreOS upgraded from 10.0.20250827-0 to 10.0.20251001-0


### Rebuilt images without code change

* [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver) git [a8ef205c](https://github.com/openshift/aws-ebs-csi-driver/commit/a8ef205c28b7b8c80b0caf1c1a9e12f81f4fdbb9) `sha256:469c6134e8be92b37f5d43252ef3a5ece5781b91d266c9cb93146e4bece2b789`
* [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal) git [fb678fec](https://github.com/openshift/cluster-api-provider-baremetal/commit/fb678fec5f7e08348b281341481f33a848204e50) `sha256:7d78c378c9b8c14864c34d4af28a49a543e3fe553a73390cee28352a0539514b`
* [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller) git [467e50fe](https://github.com/openshift/cloud-network-config-controller/commit/467e50feff5a56afbf9ccefc025781c9ccff8eca) `sha256:31081a4c84e71cb61b27656482a680bf5ee2a968488aae9f1acd6bdfaa8e61e0`
* [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver) git [ce275058](https://github.com/openshift/cluster-machine-approver/commit/ce2750589129dd20b3d1b6a5e7bb8c392d658c5c) `sha256:fb2f5288028297d90051fbeff42ee261218eb885ccfafd88a4bdf3a70bb445e7`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [2438d7c8](https://github.com/openshift/configmap-reload/commit/2438d7c8e495201361d87da205649bc38fc4822b) `sha256:9b58ff036ee3d603eca1595b01b24e202dfbf2d5b95e2ef649fa5c79608cddb2`
* [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner) git [81fca036](https://github.com/openshift/csi-external-provisioner/commit/81fca03694bca1bae8606d8970472330e1e4fcad) `sha256:5c53ef9f3c515e058487739eb9de085d6c36b18dfe5e84fb7050a300c3e799b9`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [9d55fd1a](https://github.com/openshift/driver-toolkit/commit/9d55fd1aaba05830f857132bd149ee3cf18cc20f) `sha256:47487c19afb75a2706ec04e47355cad7f50b15f455ae0a74fa93e07ba439e4f2`
* [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm) git [36ab30f9](https://github.com/openshift/cloud-provider-ibm/commit/36ab30f90e87de0daa926d20ccda88c41abed191) `sha256:2633ce7085cb59134e8f8f947c61142f8b5fe2e3a338d17c51c4f8cc69741e30`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [6c92e542](https://github.com/openshift/ironic-rhcos-downloader/commit/6c92e5425b58baa9d4dd951a992b7460e8407247) `sha256:d809ae8d5cccb93f28e0628dcc083d3f41dfa3653980e437caf09b1151d0c2c6`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [64bfec79](https://github.com/openshift/machine-os-images/commit/64bfec79ae03b50b1da5b614a4cca2937ea9927d) `sha256:57e347b0823489927a8004060a8e0fef49ae674f9f7acdccf01ca61e5abde18e`
* [multus-cni](https://github.com/openshift/multus-cni) git [cf0f68ec](https://github.com/openshift/multus-cni/commit/cf0f68ec2b5fe9bc72d0da325e02cf63968747fe) `sha256:d7a4eb941bb4c5bda0f505dea5117cf4fe7b19715b4f1249ae6ac538ffff5a06`
* [multus-cni-microshift](https://github.com/openshift/multus-cni) git [cf0f68ec](https://github.com/openshift/multus-cni/commit/cf0f68ec2b5fe9bc72d0da325e02cf63968747fe) `sha256:841d38ca6aeaf3cb76e84ce26188249e708da610675b511f636838ea412961dd`
* [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni) git [43c89591](https://github.com/openshift/whereabouts-cni/commit/43c8959152a6ca8afdc73eaed624286628c2c22e) `sha256:3b6141f85fdd1d940eb9de3604e74f5bc18786bfd4baa8774d05846f8e54133c`
* [must-gather](https://github.com/openshift/must-gather) git [f0c64742](https://github.com/openshift/must-gather/commit/f0c64742c79afce5e367ca2c7b830ad448abe1df) `sha256:d82dfd475d54e84abb84179ad94c0b9d6360a9dd2238ec80b8d3ec6ed826eeef`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:5b4522e0716acdc746a87360f8fcf19d6775d185f56c3d8a54b99913e06df504`
* [oauth-proxy](https://github.com/openshift/oauth-proxy) git [6649cb8a](https://github.com/openshift/oauth-proxy/commit/6649cb8a7c4dd7d1c4e03c9b0bc7594089fba991) `sha256:ee4f990721bc9a1c54dd586a61d3d423a7d555f275c628fe14f7e808d98bc1a6`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [f011b3c7](https://github.com/openshift/machine-api-provider-powervs/commit/f011b3c727c5377302b2ab0a203457490b930a3d) `sha256:a40f1b860de48a44b4a3ac26fd48b4ddf26371959f3cccee0cadd151bde59b89`


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/935212ab44763792799c1a89448517de70333e24)

* [OCPBUGS-62656](https://issues.redhat.com/browse/OCPBUGS-62656): Set agent-extract-tui start timeout [#9990](https://github.com/openshift/installer/pull/9990)
* [OCPBUGS-62640](https://issues.redhat.com/browse/OCPBUGS-62640): Wildcards not reliable for copying container files [#9986](https://github.com/openshift/installer/pull/9986)
* [OCPBUGS-62297](https://issues.redhat.com/browse/OCPBUGS-62297): Set default for PrivateDNSZone Project ID [#9968](https://github.com/openshift/installer/pull/9968)
* [OCPBUGS-61528](https://issues.redhat.com/browse/OCPBUGS-61528): Allow user to BYO private zone without specifying name [#9936](https://github.com/openshift/installer/pull/9936)
* [OCPBUGS-61552](https://issues.redhat.com/browse/OCPBUGS-61552): Shellcheck fix 4.20 [#9938](https://github.com/openshift/installer/pull/9938)
* [Full changelog](https://github.com/openshift/installer/compare/c805b240dc45c054ff83d57ae945772feef90ea4...935212ab44763792799c1a89448517de70333e24)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/cae310f190fccb3f0fa613de50c484afb039c098)

* [OCPBUGS-55670](https://issues.redhat.com/browse/OCPBUGS-55670): revert dev cert rotation [#1906](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1906)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/0bec046c8c10682390e2a20ae4f416a2d8589f40...cae310f190fccb3f0fa613de50c484afb039c098)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/5a7da72ce2d21fc0900b428334865d97f39f6037)

* [OCPBUGS-55217](https://issues.redhat.com/browse/OCPBUGS-55217): Throttle resourcesynccontroller on pairs with dual writers. [#882](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/882)
* [OCPBUGS-61323](https://issues.redhat.com/browse/OCPBUGS-61323): CNTRLPLANE-1275:Fixing arch issue [#870](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/870)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/3b20c534b1b92d46055147c4f82f69b2ad3044c9...5a7da72ce2d21fc0900b428334865d97f39f6037)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/b593115347e34d8075c16534a136adffcd678f6d)

* [OCPBUGS-62214](https://issues.redhat.com/browse/OCPBUGS-62214): E2E: Add function to check control plane nodes are schedulable. [#1398](https://github.com/openshift/cluster-node-tuning-operator/pull/1398)
* [OCPBUGS-62023](https://issues.redhat.com/browse/OCPBUGS-62023): release-4.20: e2e: set of fixes/changes to ovs pinning testing [#1394](https://github.com/openshift/cluster-node-tuning-operator/pull/1394)
* [OCPBUGS-62017](https://issues.redhat.com/browse/OCPBUGS-62017): E2E: llc: Create testing namespace before Runtime tests [#1393](https://github.com/openshift/cluster-node-tuning-operator/pull/1393)
* And 1 elided commits (e.g. from squash or rebase merges)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/3c890f038bc1da82298b2633c8c61f466e0b3e68...b593115347e34d8075c16534a136adffcd678f6d)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/f18c176658ed3372a73c11fd3533965cf6877ef0)

* [OCPBUGS-62175](https://issues.redhat.com/browse/OCPBUGS-62175): add all-egress label to deployments on HCP and IBM [#622](https://github.com/openshift/cluster-storage-operator/pull/622)
* [OCPBUGS-61249](https://issues.redhat.com/browse/OCPBUGS-61249): Fix logging e2e also faster cleanup [#613](https://github.com/openshift/cluster-storage-operator/pull/613)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/cfcc1f7f1f2c702118cd4b182d04c12defac6d30...f18c176658ed3372a73c11fd3533965cf6877ef0)


### [console](https://github.com/openshift/console/tree/3a110c3b1356b50eb6227e157dc97730361cd05b)

* [OCPBUGS-61926](https://issues.redhat.com/browse/OCPBUGS-61926): PVC shows negative Available space in OpenShift Console on RHOCP 4 [#15512](https://github.com/openshift/console/pull/15512)
* [OCPBUGS-61861](https://issues.redhat.com/browse/OCPBUGS-61861): cluster in workload identity mode is not applied with the token-auth-… [#15507](https://github.com/openshift/console/pull/15507)
* [OCPBUGS-61848](https://issues.redhat.com/browse/OCPBUGS-61848): Updation of label from edit label doesn't work [#15506](https://github.com/openshift/console/pull/15506)
* [OCPBUGS-62196](https://issues.redhat.com/browse/OCPBUGS-62196): Add Missing Periods to Error Messages and update try again button link [#15537](https://github.com/openshift/console/pull/15537)
* [OCPBUGS-62015](https://issues.redhat.com/browse/OCPBUGS-62015): Help dropdown should be closed automatically after tour model opened [#15519](https://github.com/openshift/console/pull/15519)
* [OCPBUGS-61990](https://issues.redhat.com/browse/OCPBUGS-61990): Change default tab size from 4 to 2 [#15515](https://github.com/openshift/console/pull/15515)
* [OCPBUGS-61671](https://issues.redhat.com/browse/OCPBUGS-61671): i18n upload/download routine task for OCP version 4.20 [#15485](https://github.com/openshift/console/pull/15485)
* [OCPBUGS-61777](https://issues.redhat.com/browse/OCPBUGS-61777): Fix improper DescriptionList refactor [#15499](https://github.com/openshift/console/pull/15499)
* [OCPBUGS-61327](https://issues.redhat.com/browse/OCPBUGS-61327): Correct the ordering of Catalog categories to be alphabetized [#15468](https://github.com/openshift/console/pull/15468)
* [OCPBUGS-61226](https://issues.redhat.com/browse/OCPBUGS-61226): fix typo in update approval strategy label [#15458](https://github.com/openshift/console/pull/15458)
* [Full changelog](https://github.com/openshift/console/compare/0748392def188dbb070308c32c1fbb3457624f95...3a110c3b1356b50eb6227e157dc97730361cd05b)


### [haproxy-router](https://github.com/openshift/router/tree/96bfd2164c7885df9019ce9eeb79d506bd7e871b)

* [OCPBUGS-61558](https://issues.redhat.com/browse/OCPBUGS-61558): Revert Prevent startup failures due to name resolution" [#674](https://github.com/openshift/router/pull/674)
* [Full changelog](https://github.com/openshift/router/compare/47274e213d8a511066a9492b73c9b8eccc353571...96bfd2164c7885df9019ce9eeb79d506bd7e871b)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/58f14fc5d33718cc2c6c38e51e05147a8303aba1)

* [OCPBUGS-62174](https://issues.redhat.com/browse/OCPBUGS-62174): Fix MCP updated machine count for image mode disabling case [#5307](https://github.com/openshift/machine-config-operator/pull/5307)
* [OCPBUGS-62675](https://issues.redhat.com/browse/OCPBUGS-62675): Cert Controller should live fetch SAN IPs during cert rotation [#5326](https://github.com/openshift/machine-config-operator/pull/5326)
* [OCPBUGS-62602](https://issues.redhat.com/browse/OCPBUGS-62602): configure-ovs: work around a Cisco switch issue [#5321](https://github.com/openshift/machine-config-operator/pull/5321)
* [OCPBUGS-62080](https://issues.redhat.com/browse/OCPBUGS-62080): Add mcd_local_unsupported_packages recording rule [#5297](https://github.com/openshift/machine-config-operator/pull/5297)
* [OCPBUGS-61882](https://issues.redhat.com/browse/OCPBUGS-61882): Add nil/null checks to image registry secret decode [#5292](https://github.com/openshift/machine-config-operator/pull/5292)
* [OCPBUGS-62073](https://issues.redhat.com/browse/OCPBUGS-62073): Improve MCN CRD clean-up script [#5296](https://github.com/openshift/machine-config-operator/pull/5296)
* [OCPBUGS-61516](https://issues.redhat.com/browse/OCPBUGS-61516): Machine-config controller should actively manage cordon while draining [#5281](https://github.com/openshift/machine-config-operator/pull/5281)
* [OCPBUGS-61824](https://issues.redhat.com/browse/OCPBUGS-61824): Override NMState service definition [#5286](https://github.com/openshift/machine-config-operator/pull/5286)
* [OCPBUGS-61232](https://issues.redhat.com/browse/OCPBUGS-61232): Recheck `generatedByControllerVersion` annotation prior to deleting a degraded MC [#5273](https://github.com/openshift/machine-config-operator/pull/5273)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/063455217c390b9196f1577378cbb8a6454de527...58f14fc5d33718cc2c6c38e51e05147a8303aba1)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/74b1c90eb97bea68bf708d47f28fce7de9adc7b9)

* [OCPBUGS-61239](https://issues.redhat.com/browse/OCPBUGS-61239): Skip node-encap-ips annotation in DPU host mode [#2763](https://github.com/openshift/ovn-kubernetes/pull/2763)
* [OCPBUGS-61778](https://issues.redhat.com/browse/OCPBUGS-61778): Adding ovndb-raft-functions.sh to ovnk image [#2760](https://github.com/openshift/ovn-kubernetes/pull/2760)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/9741174157381d7b87e2d21559cbe06b8f2b5ebf...74b1c90eb97bea68bf708d47f28fce7de9adc7b9)


### [prometheus](https://github.com/openshift/prometheus/tree/af9b206808f8eaeb4acec7fe74ba6b145bbdc921)

* [OCPBUGS-62275](https://issues.redhat.com/browse/OCPBUGS-62275): chore(scrape): default to legacy validation/escaping scheme until utf-8 is fully supported by prometheus-operator [#273](https://github.com/openshift/prometheus/pull/273)
* [OCPBUGS-61207](https://issues.redhat.com/browse/OCPBUGS-61207): chore: compute highestTimestamp at queryManager level [#264](https://github.com/openshift/prometheus/pull/264)
* [Full changelog](https://github.com/openshift/prometheus/compare/d703f9b685380fdcfa4114f4cfd463e9b68ab00d...af9b206808f8eaeb4acec7fe74ba6b145bbdc921)


### [stream-coreos, stream-coreos-extensions](https://github.com/openshift/os/tree/2b6ac09e306e4b2fa293a887ef88196bfe6c3143)

* NO-JIRA: update the okd repo for 4.21 [#1862](https://github.com/openshift/os/pull/1862)
* NO-JIRA: OWNERS: switch to joelcapitao [#1861](https://github.com/openshift/os/pull/1861)
* NO-JIRA: bump version to 4.21 [#1860](https://github.com/openshift/os/pull/1860)
* [Full changelog](https://github.com/openshift/os/compare/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f...2b6ac09e306e4b2fa293a887ef88196bfe6c3143)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/b93eb64ff72e7c005687813c8b478d694a0f517a)

* NO-JIRA: Update OWNERS [#96](https://github.com/openshift/cloud-provider-vsphere/pull/96)
* [OCPCLOUD-2933](https://issues.redhat.com/browse/OCPCLOUD-2933): Rebase onto main [#95](https://github.com/openshift/cloud-provider-vsphere/pull/95)
* [OCPBUGS-57574](https://issues.redhat.com/browse/OCPBUGS-57574): Updating ose-vsphere-cloud-controller-manager-container image to be consistent with ART for 4.20 [#92](https://github.com/openshift/cloud-provider-vsphere/pull/92)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/70242a37ac0c7e59fd4ffb539e272ea976b88eb6...b93eb64ff72e7c005687813c8b478d694a0f517a)