# 4.20.3

Created: 2025-11-06 16:02:02 +0000 UTC

Image Digest: `sha256:af6430d3149e5532af8aa51ed5810b47cb5b6afef9f805f12bc26b92321316bb`


## Changes from 4.20.2

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.5
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20251027-0 to 9.6.20251105-0


### Rebuilt images without code change

* [agent-installer-api-server](https://github.com/openshift/assisted-service) git [4b116f46](https://github.com/openshift/assisted-service/commit/4b116f46ca39a4933cab5647e5db44432c752b80) `sha256:de5a6b9ca968b998353c47d922b462542bb35dc7986964d7e8483742eb92dc8e`
* [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent) git [62dc63f1](https://github.com/openshift/assisted-installer-agent/commit/62dc63f18f2c4a6a0cf1043710d055fe57f8fa28) `sha256:51cb88fdbd7bda166d3b92df32e6a561ed23c89ebd1c7cbf4881909a20146aba`
* [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator) git [0d7067cb](https://github.com/openshift/cluster-etcd-operator/commit/0d7067cb286ad4efad5cad9bcff17656ef9827a3) `sha256:8b625d902b61b459319e84dcd727c67c625a5d186d5741d9c7834e11791d41ab`
* [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator) git [56b12e27](https://github.com/openshift/cluster-node-tuning-operator/commit/56b12e277eec356e330a9f7dac4373a1faf52af2) `sha256:3be7e032d16cb5df13209fd274294af004b4a93ac4e80103ea09cf99577ef80b`
* [docker-builder](https://github.com/openshift/builder) git [ff595e4b](https://github.com/openshift/builder/commit/ff595e4bbf5301039fc62f0cdd7b5610605f633e) `sha256:197b7ae9c335a2e0206461f5bbff7667d00e57daa2c4690e747455ab064461e5`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [9d55fd1a](https://github.com/openshift/driver-toolkit/commit/9d55fd1aaba05830f857132bd149ee3cf18cc20f) `sha256:9d2898d0bd79436eb6abfae34a52b184a83349e71cfa1729ee45e22a8817b18e`
* [keepalived-ipfailover](https://github.com/openshift/images) git [bb4535b7](https://github.com/openshift/images/commit/bb4535b7069cab2de0174be29bccccde6d623b4f) `sha256:f1b727dd4bb7da5157099fd81d41a51ba4f8636b4b9495289b496e422b5cf3eb`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [64bfec79](https://github.com/openshift/machine-os-images/commit/64bfec79ae03b50b1da5b614a4cca2937ea9927d) `sha256:a79c30055c5c9434c11963be793c30e6072e8146a89312abf1a9b0ad8c90f579`
* [metallb-frr](https://github.com/openshift/frr) git [fc0fe74f](https://github.com/openshift/frr/commit/fc0fe74f94b415b28d772dbc61f6323171a11b50) `sha256:fb8054741e2e31e4fe1d7603aa5b59489db89f5b39b4cf2617929dd01b62d631`
* [monitoring-plugin](https://github.com/openshift/monitoring-plugin) git [c6a042a6](https://github.com/openshift/monitoring-plugin/commit/c6a042a64369147cf997e5e794b89e577a3c3532) `sha256:25a27c4cc546f4f8d191bc872d29e0c0ee4489740f02549c500067d1c14b5d67`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:96c43d2731064af8ecb61f8becae4dbf0dfd28171efea26d661bf9dfdf342246`
* [openstack-cinder-csi-driver](https://github.com/openshift/cloud-provider-openstack) git [c4fe3e8a](https://github.com/openshift/cloud-provider-openstack/commit/c4fe3e8ad29e58f081f3883de0893c2025a097b2) `sha256:551d39bec08360f366ff39f23d440be0f66c1b125cc24bc6700e6768a75d9250`
* [rhel-coreos](https://github.com/openshift/os) git [63e9aa40](https://github.com/openshift/os/commit/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f) `sha256:4a46631750682bbdc86d144dcb16a45ff8f3ee195b3d8357e0781d3c48f89b1b`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [63e9aa40](https://github.com/openshift/os/commit/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f) `sha256:51559d3100bcc1db118c3853ef3d83bca6ff5eda3de8bcd395a096654383d1ad`
* [tools](https://github.com/openshift/oc) git [7f1d6f88](https://github.com/openshift/oc/commit/7f1d6f88cb0c8ed5c877fc0ae2bd99298c6339f2) `sha256:18fe3e3a76c7221dde1b7d1f5cfa6e772840bf8b987cc6d49140958eec34eb54`


### [aws-cloud-controller-manager, aws-cluster-api-controllers, aws-ebs-csi-driver, aws-ebs-csi-driver-operator, aws-machine-controllers, aws-pod-identity-webhook, azure-cloud-controller-manager, azure-cloud-node-manager, azure-cluster-api-controllers, azure-disk-csi-driver, azure-disk-csi-driver-operator, azure-file-csi-driver, azure-file-csi-driver-operator, azure-machine-controllers, azure-workload-identity-webhook, csi-driver-manila, csi-driver-manila-operator, csi-driver-nfs, gcp-cloud-controller-manager, gcp-cluster-api-controllers, gcp-machine-controllers, gcp-pd-csi-driver, gcp-pd-csi-driver-operator, hyperkube, ironic, ironic-agent, ironic-machine-os-downloader, ironic-static-ip-manager, kube-proxy, machine-image-customization-controller, nutanix-cloud-controller-manager, nutanix-machine-controllers, pod, powervs-block-csi-driver, powervs-block-csi-driver-operator, powervs-cloud-controller-manager, powervs-machine-controllers, vsphere-cloud-controller-manager, vsphere-cluster-api-controllers, vsphere-csi-driver, vsphere-csi-driver-operator, vsphere-csi-driver-syncer, vsphere-problem-detector](https://github.com/openshift/kubernetes/tree/cf396bff09dcb68a96f718b5e0e80b50e874afb5)

* NO-JIRA: enable CBOR tests [#2502](https://github.com/openshift/kubernetes/pull/2502)
* [Full changelog](https://github.com/openshift/kubernetes/compare/debdebd535dc3f5d0ab3557aa79172ff92344d97...cf396bff09dcb68a96f718b5e0e80b50e874afb5)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/200070b922dcf6bfd4819d7063f13e14ea296241)

* [OCPBUGS-63633](https://issues.redhat.com/browse/OCPBUGS-63633): Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 [#10037](https://github.com/openshift/installer/pull/10037)
* [Full changelog](https://github.com/openshift/installer/compare/cbd9f67f1260b158294f7dd16a87863c139702cb...200070b922dcf6bfd4819d7063f13e14ea296241)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/17948f42adc4fce592908d48730f45d665bcbbba)

* [OCPBUGS-63546](https://issues.redhat.com/browse/OCPBUGS-63546): ccoctl: add public-key-file flag to create-all [#936](https://github.com/openshift/cloud-credential-operator/pull/936)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/d391c0b339c48f49711ccff9ebac62039bf5c6f7...17948f42adc4fce592908d48730f45d665bcbbba)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)

* [OCPBUGS-63542](https://issues.redhat.com/browse/OCPBUGS-63542): Change the capacity struct from int to ptrOfInt [#185](https://github.com/openshift/cloud-network-config-controller/pull/185)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/467e50feff5a56afbf9ccefc025781c9ccff8eca...a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/276696ccf679830b25df341edb7aae9bb3f4e763)

* [OCPBUGS-63164](https://issues.redhat.com/browse/OCPBUGS-63164): ccm: disable unused secure-serving port and webhook [#419](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/419)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/e355ad389d1d09be1a83f024f54b15e844982d0a...276696ccf679830b25df341edb7aae9bb3f4e763)


### [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator/tree/234e218207ec963df04ec1fedad85a421eb7a1ff)

* [OCPBUGS-63173](https://issues.redhat.com/browse/OCPBUGS-63173): Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.20 [#62](https://github.com/openshift/cluster-api-operator/pull/62)
* [Full changelog](https://github.com/openshift/cluster-api-operator/compare/3ec30377ffff951dc9c0fc2257d290e4b4958465...234e218207ec963df04ec1fedad85a421eb7a1ff)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/438c9dba80ddadeabe9efe4a654297a7b550b2b8)

* [OCPBUGS-64684](https://issues.redhat.com/browse/OCPBUGS-64684): Add priority field to prevent early shutdown [#890](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/890)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/5a7da72ce2d21fc0900b428334865d97f39f6037...438c9dba80ddadeabe9efe4a654297a7b550b2b8)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/b3c82b2eec66ae3ae510df0603af1212c34be618)

* [OCPBUGS-63587](https://issues.redhat.com/browse/OCPBUGS-63587): port 9193 need to be internal and port 9194 need to have a service [#280](https://github.com/openshift/cluster-machine-approver/pull/280)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/ce2750589129dd20b3d1b6a5e7bb8c392d658c5c...b3c82b2eec66ae3ae510df0603af1212c34be618)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/870b44fc269ae4e790a3487d1795880d93ff72a9)

* [OCPBUGS-62978](https://issues.redhat.com/browse/OCPBUGS-62978): add tls configuration for the monitoring plugin deployment [#2718](https://github.com/openshift/cluster-monitoring-operator/pull/2718)
* [OCPBUGS-62829](https://issues.redhat.com/browse/OCPBUGS-62829): Remove cluster from non-multicluster dashboards [#2701](https://github.com/openshift/cluster-monitoring-operator/pull/2701)
* [OCPBUGS-64577](https://issues.redhat.com/browse/OCPBUGS-64577): Fix KSM deny-list typo [#2729](https://github.com/openshift/cluster-monitoring-operator/pull/2729)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/c2dfaad07a7098d4b88df54d88fa2b77f18df52b...870b44fc269ae4e790a3487d1795880d93ff72a9)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/b343f70f19ffd559e1a81d3a3e65bd106e634c13)

* [OCPBUGS-63507](https://issues.redhat.com/browse/OCPBUGS-63507): references to github.com/sclorg/django-ex.git now also refer to the branch [#655](https://github.com/openshift/cluster-samples-operator/pull/655)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/62b3623c6a2860e7a8cc368dbe76e767508cd261...b343f70f19ffd559e1a81d3a3e65bd106e634c13)


### [console](https://github.com/openshift/console/tree/e58e5b0246b82eb1c4a4a05957c9f6ef9c62ee40)

* [OCPBUGS-63608](https://issues.redhat.com/browse/OCPBUGS-63608): Fix catalog search relevance scoring, so that operators with attribute.keywords are displayed and remove unnecessary metadataName from calculation [#15648](https://github.com/openshift/console/pull/15648)
* [Full changelog](https://github.com/openshift/console/compare/c169e287163011576d8eae2576a8e4b9069b2a27...e58e5b0246b82eb1c4a4a05957c9f6ef9c62ee40)


### [console-operator](https://github.com/openshift/console-operator/tree/cdbc995ad9906b20a6048630d5d8af285bad7cc5)

* [OCPBUGS-64602](https://issues.redhat.com/browse/OCPBUGS-64602): Remove v1alpha1 ConsolePlugin version from CRDs status [#1060](https://github.com/openshift/console-operator/pull/1060)
* [Full changelog](https://github.com/openshift/console-operator/compare/5e127e5f49c56b47914e2ba4aedb09e99b165800...cdbc995ad9906b20a6048630d5d8af285bad7cc5)


### [etcd](https://github.com/openshift/etcd/tree/eac09c01677bb03daed156d407be27785fd61e0d)

* [OCPBUGS-63474](https://issues.redhat.com/browse/OCPBUGS-63474): 4.20 rebase 3.5.24 [#347](https://github.com/openshift/etcd/pull/347)
* [Full changelog](https://github.com/openshift/etcd/compare/9c065d4d842c8de57806426c13201413b4d595e2...eac09c01677bb03daed156d407be27785fd61e0d)


### [hypershift](https://github.com/openshift/hypershift/tree/a28b548128e1963b2e4166268471957a3457f70b)

* [OCPBUGS-63128](https://issues.redhat.com/browse/OCPBUGS-63128): resolve initContainer permission issue after node reboot [#7080](https://github.com/openshift/hypershift/pull/7080)
* [Full changelog](https://github.com/openshift/hypershift/compare/14be17ccb7fbc772a701aeecf32ee623b41858d0...a28b548128e1963b2e4166268471957a3457f70b)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/a94ae791d499025954a6f99d724e4195b450de07)

* [OCPBUGS-63534](https://issues.redhat.com/browse/OCPBUGS-63534): Create temporal allow policy [#5373](https://github.com/openshift/machine-config-operator/pull/5373)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/d239f7a5eacf418d8333d021dc02abe3ec176ace...a94ae791d499025954a6f99d724e4195b450de07)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/9de315953ad1b357c35003937a1a2f27aa9068e0)

* Hide VirtualMachine networks page in 4.20 release [#290](https://github.com/openshift/networking-console-plugin/pull/290)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f09c58b909fd6479e0099f7962ef73b70e280685...9de315953ad1b357c35003937a1a2f27aa9068e0)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/b598121bb70555120dde8d60fa9fbcde4f7b3d65)

* [OCPBUGS-63030](https://issues.redhat.com/browse/OCPBUGS-63030): removes unintended exec permissions [#1291](https://github.com/openshift/oc-mirror/pull/1291)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/b51b46d4d6000054d1a11568b3302f709a28bdde...b598121bb70555120dde8d60fa9fbcde4f7b3d65)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/8a02fda7f45172bf487a0c613cf47caaf1116d36)

* [OCPBUGS-63007](https://issues.redhat.com/browse/OCPBUGS-63007): kubevirt: fix bad release of IPs of live migratable pods [#2801](https://github.com/openshift/ovn-kubernetes/pull/2801)
* [OCPBUGS-63577](https://issues.redhat.com/browse/OCPBUGS-63577): [release-4.20] CORENET-6055: Dockerfile: Unpin OVN and consume the latest from FDP. [#2808](https://github.com/openshift/ovn-kubernetes/pull/2808)
* [OCPBUGS-63631](https://issues.redhat.com/browse/OCPBUGS-63631): Skip Pending pods in EgressIP status updates [#2831](https://github.com/openshift/ovn-kubernetes/pull/2831)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/050ed2c215b55aef456c73c5217427600756ae75...8a02fda7f45172bf487a0c613cf47caaf1116d36)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/fa749d65d8eca1cc937554baab91385a78ec8ce1)

* [OCPBUGS-63624](https://issues.redhat.com/browse/OCPBUGS-63624): bump github.com/prometheus/procfs to v0.16.1 [#173](https://github.com/openshift/node_exporter/pull/173)
* [Full changelog](https://github.com/openshift/node_exporter/compare/56f6158e797ab80e5e0da2cb0ba701cb02902ef7...fa749d65d8eca1cc937554baab91385a78ec8ce1)


### [tests](https://github.com/openshift/origin/tree/be01d22067bd78a7c62e5fac4d98567c939a49b1)

* [OCPBUGS-64593](https://issues.redhat.com/browse/OCPBUGS-64593): [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support [#30415](https://github.com/openshift/origin/pull/30415)
* [OCPBUGS-63725](https://issues.redhat.com/browse/OCPBUGS-63725): CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift [#30439](https://github.com/openshift/origin/pull/30439)
* [Full changelog](https://github.com/openshift/origin/compare/0913987edd6a422327a2f68e254a9d0eec8ee8ed...be01d22067bd78a7c62e5fac4d98567c939a49b1)