# 4.20.0-okd-scos.9

Created: 2025-11-17 05:30:36 +0000 UTC

Image Digest: `sha256:2237a02fc4d1554e655d3f4f7dd12c56109675dcf0c1189ef937941f8876257f`

Promoted from registry.ci.openshift.org/origin/release-scos:4.20.0-0.okd-scos-2025-11-16-192318


## Changes from 4.20.0-okd-scos.8

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.5
* Kubernetes Tests 1.33.4
* CentOS Stream CoreOS 10.0.20251023-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| ExternalOIDCWithUIDAndExtraClaimMappings <br/> (5 tests)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled| Enabled| Enabled| Enabled |
| ExternalOIDC <br/> (9 tests)| Enabled| Enabled<br/>(Changed)| Enabled| Enabled| Enabled| Enabled |


### Rebuilt images without code change

* [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator) git [17948f42](https://github.com/openshift/cloud-credential-operator/commit/17948f42adc4fce592908d48730f45d665bcbbba) `sha256:57f3aa1dd9b53d2d0d0bcb3aaa31a580bd09796eddcde97111e58a111f882732`
* [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator) git [58cbd296](https://github.com/openshift/cluster-kube-scheduler-operator/commit/58cbd296eecc61c0871739588ae65af9c05e87a6) `sha256:b9bfbd59e7f5e692935c21488a7106bb66b69c8eb9de5713d788476448b7d0cc`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [5adc1429](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/5adc14299739bc64c8812cbab0b0ff2d12863602) `sha256:b01e5e9dbbbe403323087a7c0b24c3377d896e879dc9074d80a6a7be3a1ac8bf`
* [cluster-network-operator](https://github.com/openshift/cluster-network-operator) git [1666a71c](https://github.com/openshift/cluster-network-operator/commit/1666a71c205071b6d44bfa57c0ebd3f0054fa1cd) `sha256:157ed22ac31e246b258bd49e9454876c4e3a8ea8a67d38e2f854e6428d84f0d4`
* [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator) git [e0ad050a](https://github.com/openshift/gcp-pd-csi-driver-operator/commit/e0ad050a84bab669e0f11e080fc4c388ef417bba) `sha256:c19fff77040aec65215e1a8102ee3bd0e5686011507517048067cb1f1bce9e6b`
* [olm-catalogd](https://github.com/openshift/operator-framework-operator-controller) git [3e2401f2](https://github.com/openshift/operator-framework-operator-controller/commit/3e2401f23ef666e8f33789a397d81a7d352b0a33) `sha256:123db214e23dd3965b2c0c7e60a23c1885764aadf6f3744c12b73fa41acf1f24`
* [olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller) git [3e2401f2](https://github.com/openshift/operator-framework-operator-controller/commit/3e2401f23ef666e8f33789a397d81a7d352b0a33) `sha256:b5dcfa62693fdd0d7ca3da4adc812ab0ae21fd57a1cefecbc14360dcb7f47627`
* [ovirt-csi-driver](https://github.com/openshift/ovirt-csi-driver) git [1db726a9](https://github.com/openshift/ovirt-csi-driver/commit/1db726a940d5ec150fd185a215f1368990653082) `sha256:9caf16aa1fc875592fa298bd9533b927856bd38119f34e41ee9e8200ab3a0290`
* [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector) git [9d55c028](https://github.com/openshift/vsphere-problem-detector/commit/9d55c028b27bc63c687342f0b7172ce39e07ec5a) `sha256:8fc184a75c7cc240b06cee936dafa73de0f97ace516e126941d561d3ca2a7b11`


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/85eb45b031daa960f76f4bb1ee56ceb85857cd1d)

* [OCPBUGS-65586](https://issues.redhat.com/browse/OCPBUGS-65586): Update the RHCOS 4.20 bootimage metadata to 9.6.202511… [#10084](https://github.com/openshift/installer/pull/10084)
* [OCPBUGS-64924](https://issues.redhat.com/browse/OCPBUGS-64924): Azure UPI ARM template: use storageAccountId [#10069](https://github.com/openshift/installer/pull/10069)
* [OCPBUGS-64595](https://issues.redhat.com/browse/OCPBUGS-64595): Remove pending items on gcp no-op [#10056](https://github.com/openshift/installer/pull/10056)
* [Full changelog](https://github.com/openshift/installer/compare/200070b922dcf6bfd4819d7063f13e14ea296241...85eb45b031daa960f76f4bb1ee56ceb85857cd1d)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/0808e14637d72c01a3cb50e41617576836e84524)

* [OCPBUGS-65523](https://issues.redhat.com/browse/OCPBUGS-65523): fix(must-gather): do not set node affinity if nodename is set [#2142](https://github.com/openshift/oc/pull/2142)
* [Full changelog](https://github.com/openshift/oc/compare/0581d703b56b153b941022bca4ce3c34de576f3c...0808e14637d72c01a3cb50e41617576836e84524)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/d22915bc82993ce11cb3fb97e6ae00602f30549b)

* [OCPBUGS-64742](https://issues.redhat.com/browse/OCPBUGS-64742): Fix capacity calculation [#188](https://github.com/openshift/cloud-network-config-controller/pull/188)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/a365cf9c9f9f4d0d7841dead5145f7cc59dfac18...d22915bc82993ce11cb3fb97e6ae00602f30549b)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/6b4cf65c2b56f8cae93032091f33c72c3f7e2f12)

* [OCPBUGS-61896](https://issues.redhat.com/browse/OCPBUGS-61896): set appropriate rolling update settings [#792](https://github.com/openshift/cluster-authentication-operator/pull/792)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/c9067c2a4902b0afeb3b288c4ff56fa381a1d1e0...6b4cf65c2b56f8cae93032091f33c72c3f7e2f12)


### [cluster-config-api](https://github.com/openshift/api/tree/1886180ef4300f41168c2d498e0acecd02fa2a48)

* [OCPBUGS-64843](https://issues.redhat.com/browse/OCPBUGS-64843): payload-command: remove authentication CR from hypershift payload [#2573](https://github.com/openshift/api/pull/2573)
* [OCPBUGS-64940](https://issues.redhat.com/browse/OCPBUGS-64940): Promote BYO OIDC features [#2515](https://github.com/openshift/api/pull/2515)
* [Full changelog](https://github.com/openshift/api/compare/41627d81e9c18fbcc3f7ff6de2ba50e0b98435c4...1886180ef4300f41168c2d498e0acecd02fa2a48)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/a3414ab9e446c5511cc8bc1011a859ecfcf5c610)

* [OCPBUGS-62057](https://issues.redhat.com/browse/OCPBUGS-62057): OpenShift cluster got degraded after rotating the kube-apiserver-service-network-signer cert [#1961](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1961)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/263f18b6c9eb82e4aabf586093b2cc711e674e77...a3414ab9e446c5511cc8bc1011a859ecfcf5c610)


### [console](https://github.com/openshift/console/tree/c1795633ef8978f9fa8f8f677bdac6dff16727b5)

* [OCPBUGS-61330](https://issues.redhat.com/browse/OCPBUGS-61330): fix namespace path generation for non-namespaced resources [#15498](https://github.com/openshift/console/pull/15498)
* [OCPBUGS-62953](https://issues.redhat.com/browse/OCPBUGS-62953): Automatically redirect all-namespaces catalog to default namespace [#15640](https://github.com/openshift/console/pull/15640)
* [OCPBUGS-64862](https://issues.redhat.com/browse/OCPBUGS-64862): Convert standalone terminal route to extension [#15702](https://github.com/openshift/console/pull/15702)
* [OCPBUGS-63499](https://issues.redhat.com/browse/OCPBUGS-63499): Turn on `fContentSecurityPolicyEnabled` by default [#15639](https://github.com/openshift/console/pull/15639)
* [OCPBUGS-64639](https://issues.redhat.com/browse/OCPBUGS-64639): HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … [#15673](https://github.com/openshift/console/pull/15673)
* [Full changelog](https://github.com/openshift/console/compare/d568950eaea74c15da2c3e5a89d95fcc0b5cc90a...c1795633ef8978f9fa8f8f677bdac6dff16727b5)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/eeae3b042d3de06808d00c7f4e72c014e25ffb1c)

* [OCPBUGS-64811](https://issues.redhat.com/browse/OCPBUGS-64811): Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 [#355](https://github.com/openshift/cloud-provider-openstack/pull/355)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/c4fe3e8ad29e58f081f3883de0893c2025a097b2...eeae3b042d3de06808d00c7f4e72c014e25ffb1c)


### [docker-builder](https://github.com/openshift/builder/tree/8c0a564f464540d0e2ffc0ce4c98d90a730bc2d2)

* [OCPBUGS-64857](https://issues.redhat.com/browse/OCPBUGS-64857): BuildConfig inline Dockerfile fails with heredoc syntax [#483](https://github.com/openshift/builder/pull/483)
* [Full changelog](https://github.com/openshift/builder/compare/ff595e4bbf5301039fc62f0cdd7b5610605f633e...8c0a564f464540d0e2ffc0ce4c98d90a730bc2d2)


### [hypershift](https://github.com/openshift/hypershift/tree/89f52bf07c21e522c1f9e8f59d00599bf53c52a5)

* [CORENET-6484](https://issues.redhat.com/browse/CORENET-6484): Restart ovnkube-control-plane pods when restart-date annotation is set [#7190](https://github.com/openshift/hypershift/pull/7190)
* [OCPBUGS-63509](https://issues.redhat.com/browse/OCPBUGS-63509): fix(ingress): add LoadBalancerSourceRanges support for external router service [#7098](https://github.com/openshift/hypershift/pull/7098)
* [OCPBUGS-64848](https://issues.redhat.com/browse/OCPBUGS-64848): feat: Promote ExternalOIDCWithUIDAndExtraClaimMappings feature to GA for Hypershift [#7204](https://github.com/openshift/hypershift/pull/7204)
* [OCPBUGS-61774](https://issues.redhat.com/browse/OCPBUGS-61774): fix(capi-provider): use single replica deployment for aws and azure [#6834](https://github.com/openshift/hypershift/pull/6834)
* [CNTRLPLANE-1908](https://issues.redhat.com/browse/CNTRLPLANE-1908): control-plane-operator-4-20 Konflux pipelines [#7216](https://github.com/openshift/hypershift/pull/7216)
* [OCPBUGS-63539](https://issues.redhat.com/browse/OCPBUGS-63539): remove NTO Service and ServiceMonitor [#7099](https://github.com/openshift/hypershift/pull/7099)
* [Full changelog](https://github.com/openshift/hypershift/compare/73e8a0ef65aa019bad67eae70987f5ca71edda52...89f52bf07c21e522c1f9e8f59d00599bf53c52a5)


### [ironic](https://github.com/openshift/ironic-image/tree/422f3189a49680ca0574f9e88b1da27a2e227fea)

* [OCPBUGS-64820](https://issues.redhat.com/browse/OCPBUGS-64820): Fix IPA external inspection callback url override [#713](https://github.com/openshift/ironic-image/pull/713)
* [Full changelog](https://github.com/openshift/ironic-image/compare/9c57a81902530b0268eddd7ad623a972b5ba4042...422f3189a49680ca0574f9e88b1da27a2e227fea)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/1f11aef23bd1a7d89fba38480451e2404e00f3a3)

* [OCPBUGS-65556](https://issues.redhat.com/browse/OCPBUGS-65556): [release-4.20] Backport: Add delays to reduce TestOSBuildController failures [#5396](https://github.com/openshift/machine-config-operator/pull/5396)
* [OCPBUGS-64822](https://issues.redhat.com/browse/OCPBUGS-64822): remove check for conflicting ClusterImagePolicy in syncUpgradeableStatus [#5413](https://github.com/openshift/machine-config-operator/pull/5413)
* [OCPBUGS-65509](https://issues.redhat.com/browse/OCPBUGS-65509): e2e gcp ocl PR backport [#5407](https://github.com/openshift/machine-config-operator/pull/5407)
* [OCPBUGS-64822](https://issues.redhat.com/browse/OCPBUGS-64822): Implement upgrade blocking for conflicting ClusterImagePolicy named "openshift" [#5397](https://github.com/openshift/machine-config-operator/pull/5397)
* [OCPBUGS-59766](https://issues.redhat.com/browse/OCPBUGS-59766): Update timing of MCN desired config spec update to align with node annotation setting [#5367](https://github.com/openshift/machine-config-operator/pull/5367)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/b9dbf396412a463e6828332ce28a2ff514424e9e...1f11aef23bd1a7d89fba38480451e2404e00f3a3)


### [metallb-frr](https://github.com/openshift/frr/tree/3ca45c517eafe07aac0866e5cbd32a5c08081f22)

* [OCPBUGS-65516](https://issues.redhat.com/browse/OCPBUGS-65516): [release-4.20] Dockerfile: unpin FRR rpm [#111](https://github.com/openshift/frr/pull/111)
* [Full changelog](https://github.com/openshift/frr/compare/fc0fe74f94b415b28d772dbc61f6323171a11b50...3ca45c517eafe07aac0866e5cbd32a5c08081f22)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/dd6d22bd02554c039e7bbec4bf39c6e97ebf0b9b)

* [OCPBUGS-64724](https://issues.redhat.com/browse/OCPBUGS-64724): Fix TOCTOU race condition in ensureInstallPlan (#3682) [#1139](https://github.com/openshift/operator-framework-olm/pull/1139)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/10d327b38876b2fbc654ddc54eee6199ea0dbbb8...dd6d22bd02554c039e7bbec4bf39c6e97ebf0b9b)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/798404b42c0fd11b62973803dbc53810fd4f7fee)

* [OCPBUGS-64697](https://issues.redhat.com/browse/OCPBUGS-64697): [release-4.20] Referencing pod named ports within a service results in bad DNAT rules containing tcp/0 target port [#2844](https://github.com/openshift/ovn-kubernetes/pull/2844)
* [OCPBUGS-63686](https://issues.redhat.com/browse/OCPBUGS-63686): Fix stale EIP assignments during failover and controller restart [#2835](https://github.com/openshift/ovn-kubernetes/pull/2835)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/c7e12ae3e00d8fdc6744815370e450bcc68c0dac...798404b42c0fd11b62973803dbc53810fd4f7fee)


### [tests](https://github.com/openshift/origin/tree/1d3ad0d8f1696239bd98909e6f2864400607695b)

* [OCPBUGS-63656](https://issues.redhat.com/browse/OCPBUGS-63656): Redact bearertoken in TestContext [#30435](https://github.com/openshift/origin/pull/30435)
* [Full changelog](https://github.com/openshift/origin/compare/b4a97e59b086e20d856d2fca30e27cbf994ed4a8...1d3ad0d8f1696239bd98909e6f2864400607695b)