4.20.22

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.20.22-x86_64

Team Approvals:

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-serial-2of2
- aws-ovn-single-node-upgrade-4.20-micro Succeeded periodic-ci-openshift-release-main-ci-4.20-e2e-aws-upgrade-ovn-single-node
- aws-ovn-upgrade-4.20-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-upgrade-fips
- azure-ovn-upgrade-4.20-micro Succeeded periodic-ci-openshift-release-main-ci-4.20-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.20-fips-payload-scan
- gcp-ovn-rt-upgrade-4.20-minor Pending (1 retry) periodic-ci-openshift-release-main-ci-4.20-upgrade-from-stable-4.19-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- hypershift-ovn-conformance-4.20 Succeeded periodic-ci-openshift-hypershift-release-4.20-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-bm Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-metal-ipi-ovn-bm
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.20-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.20-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.19.18, 4.19.19, 4.19.21, 4.19.22, 4.19.23, 4.19.24, 4.19.27, 4.19.28, 4.20.11, 4.20.12, 4.20.13, 4.20.14, 4.20.16, 4.20.18, 4.20.3, 4.20.4, 4.20.5, 4.20.6, 4.20.8, 4.20.9

4.20.21 (changes) - S S S S F S
4.20.20 (changes) - Success
4.20.19 (changes) - Failed
4.20.17 (changes) - Failed
4.20.15 (changes) - Failed
4.20.10 - Success
4.20.2 (changes) - Success
4.20.1 (changes) - Failed
4.20.0 (changes) - Failed
4.19.31 (changes) - Success
4.19.30 (changes) - F S S
4.19.29 (changes) - Success
4.19.26 (changes) - Failed
4.19.25 (changes) - Success
4.19.20 (changes) - Success
4.19.17 (changes) - Failed
4.19.16 (changes) - Success
4.19.15 (changes) - Failed
4.19.0-0.nightly-2026-05-11-215505 (changes) - Failed Pending

Upgrades to:

4.21.15 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.20.10

Created: 2026-05-12 09:00:21 +0000 UTC

Image Digest: sha256:1b8a542fb7b17aa2999387caacf3b6601827a7fa7c630c9449964ac32d743caa

Components

Kubectl 1.33.3
Kubernetes upgraded from 1.33.6 to 1.33.10
Kubernetes Tests 1.33.4
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20251219-0 to 9.6.20260510-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
PreconfiguredUDNAddresses (10 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled

Removed images

libvirt-machine-controllers

Rebuilt images without code change

agent-installer-node-agent git 637327ec sha256:a702481cb1c023f6144fca62de754ce6e84cc3164b32a0745ccd29752f7d9ee7
apiserver-network-proxy git 11b24a2c sha256:0131359350b329c4d55d100027fe38dcbfb65d60c1f46f17856afcba51ca4222
aws-cloud-controller-manager git bb88da16 sha256:206a5e3bcfa14158fd77c0d61893b4b8b1a7434e584eaee9a92154141912e436
aws-cluster-api-controllers git 300439ea sha256:f19c19c061c6999d856c2b45b88a566628969c95fe29a89ed4f97cd8fd694c59
aws-ebs-csi-driver git a8ef205c sha256:8b101ce460baa6f40ee5d2702a85d37ca070e292766b67254f3877969abf341c
aws-karpenter-provider-aws git b37141b0 sha256:ce68134191d904e7162a4d65deb2b27318c0519b71645e2d2f69f76ce14e85ed
azure-cloud-controller-manager git d469d04e sha256:6600051a3537016bf2b78d34994e8b59e958388b605c0e81dabbcc193c59457a
azure-cloud-node-manager git d469d04e sha256:ae9f7621e4ad6660f73529cfdbbbe1a609d503d9ac2bc5dfb43692bbee31664d
azure-cluster-api-controllers git cb8b5b6a sha256:8c7f6f56b3e5702d7f6752a3069d7538d1a2c4e2954fdc04b8d939c946ef7e20
azure-disk-csi-driver git 0b8e4d22 sha256:6645dda1f389cb2271324304519fd0e6ce33b9e1af83ddb5fbcd72f850f04ae5
azure-file-csi-driver git 45d505bc sha256:4245facda4eb4806ebef96f83895729d9c34bc7fe0c29c9f5add723ec791bf06
azure-machine-controllers git 68db9150 sha256:9acb25a6eb1f58a0f08d2e53c302577a79eedd1ddfbc39df9d13f05d045adcd2
azure-service-operator git 6e2f3626 sha256:e4f3e9fd575dddb2a2b35fb9b3d0579de84ac5fa12bf19bf0b4938757a4455b0
azure-workload-identity-webhook git 88b18175 sha256:f34060dd53e0641cb6e09b8c27ebd68aa25166cc18f1069fcf9fc8e23369ebf2
baremetal-cluster-api-controllers git f782ba74 sha256:3d70dc8cb31d13e0fcb17b2ac922e91c22c82052f518c0316209ae0939bdc7dd
baremetal-machine-controllers git fb678fec sha256:b6aa092042af6a0fd1af5d6d0d33637c63c3bc7326409cadb2cfb237d07fd9e0
cloud-network-config-controller git d22915bc sha256:41183115abc3ef5fd4a79e75c24bf3d4c98c7f80ed761160c0ec5368ba729313
cluster-authentication-operator git fb1a9ab2 sha256:d2eee00cc3f00709f8441d53cbf61ffb5b697ae7cc9445ba03e75ee23e03eafa
cluster-autoscaler-operator git 147e5a7f sha256:4344b5680e7929c1e75a577eb52cdb3ee4680c84f5056bfb0efeb0c92464f75b
cluster-bootstrap git 74abc555 sha256:a01decebaf9b25f1f1e6bacba3e5408a2212c756ed8803d9300aec5a4248399b
cluster-capi-controllers git de1db297 sha256:1b3355a5d3eef77c92274bc1670b2961c6f6210983254b060c23c53124929456
cluster-capi-operator git acf33144 sha256:e5bc58d98c6683e772a1de8cb189cb4d87dc85d202f620aeb74ae77133139002
cluster-cloud-controller-manager-operator git 276696cc sha256:bad724c2ed36646041ad9969de4b60ddac2b958e5b18b3c6f4274af385137296
cluster-config-operator git 657754e2 sha256:1aca8220659339d84eeab4c2023ec3a6f09f45bf6efb8358d4265e581a725497
cluster-control-plane-machine-set-operator git 0bbafe24 sha256:1d212a46dd1ba91344282fda009399e663f32ee9cb2038d431f2f092f2d5efeb
cluster-dns-operator git 82578923 sha256:de79962244a4fbf50724af3ec89cd9c3720eee6dd8325d94e74fa7f4b08df93a
cluster-image-registry-operator git b04c7c12 sha256:2f4ecfe55da3a701cbd7cfc2c0d1b149f050eff9072725b265eb3aefa3e92d38
cluster-kube-cluster-api-operator git 234e2182 sha256:1e31570e5cfbd54b3ff2de91b317eaffecb58a4b3b2b6bae789eb3fe807ab148
cluster-kube-controller-manager-operator git 438c9dba sha256:931b9f28e829d04c936c2f7a937263b30314dbb9700094f3653e88baa8b7c0a9
cluster-kube-storage-version-migrator-operator git 5adc1429 sha256:73d7a6cd1f3f7c96331e04d0ff7b6c5787d52927148b26dc22e4b93181a815d5
cluster-machine-approver git b3c82b2e sha256:5d497397b71c226f15099ff8c093a50d48ca9a100145d8f87a8c92987ba673f8
cluster-olm-operator git e4917368 sha256:f7813308c97db8e14c91b0664d400bb5225da0da7a8494672cf2b09a38f92e9e
cluster-openshift-apiserver-operator git 9cfa5679 sha256:9b1c878d142c1377c3428e119bcd7ee078127ab8cb257046669264e84a125d73
cluster-openshift-controller-manager-operator git aa455c04 sha256:54afe0c1273ee6757f94accad47c15611fb0d592abe0ee5312ec041d81c9b612
cluster-policy-controller git 47c78310 sha256:42be4b285fd28ac442c23331385a20f7653bfba9dacecd13370dacdb75fff335
cluster-samples-operator git b343f70f sha256:19dc9bfd3fc3cbc158152ac33c7a5a0dbd491421eb3fe5e9453cdee1f5cc41e9
cluster-update-keys git c40e7b9b sha256:9252be3e6714421ba45d35d06de493ffcad5aa9fadb5ced7e07458165f9ca82d
configmap-reloader git 2438d7c8 sha256:3ddef83742ce1e21a08e2b99c18258d487251863e914d5626811fbedbed84dab
container-networking-plugins git 184a9601 sha256:0b4905a398a779c8155876a48fa417ca90ac9941a531fb392b9471e9ea849ef1
containernetworking-plugins-microshift git 184a9601 sha256:d085d5bac139e0ec720776a22bf51ff836c54ce6f9b947ee51218ea17ea9f5f8
coredns git 6f39336e sha256:b711efb591eddc8d55bd32eadec299b63287b8041093b227d2d31cccc6d8a5a2
csi-driver-nfs git 1abaf844 sha256:a4d4d99fb53562f3d56661a1802b8491d2b50156346ebd0149351bc5152e88c1
csi-external-attacher git 45239149 sha256:077da8b01b8d7e4d0f753e99fcf41d4a2091d6865c205f64c8fecec1575241d4
csi-external-provisioner git 81fca036 sha256:a64dccdc647ac1c0f0ca29b74e15b328a3f62f0a46d2a563c6e2841f9ecb01d1
csi-external-resizer git c674bea9 sha256:24ad86c3b010d127686550e0cfa1cfe4ae9f4d64778cef6c244fa48d0617623d
csi-external-snapshot-metadata git 693a8264 sha256:7676868c1fa5cd2bd7fef8afdd928a3b80ffd89cf19fd8086b64269f9677595f
csi-external-snapshotter git 42604822 sha256:1b9ebae30a269e6511597904ff480515caad89dbe11477f3a251dec58f784c92
csi-livenessprobe git 1d6d6b27 sha256:ccf6bdeaf2a070edacb7c24a4e46af27a65dc25faf0fb4edc37cdfa922109b67
csi-node-driver-registrar git 6ce4713c sha256:715fed4adf4280d9a8e92a09cdcc35ed9bb95e623b1d5fc2f1b753981ecf41f4
csi-snapshot-controller git 42604822 sha256:9d0d44230fd7348facab7daf601dae69cff078ee340d760c9b62ba1718540fec
egress-router-cni git 5e0f8d1b sha256:3d1cfa2c2499c2f44f7c17950e8764e335ba29057851109f60e6af8619b3e56c
gcp-cluster-api-controllers git 65539c71 sha256:e9706327efdc5f6d52573d0f43f8282f63e4a2b116050a695a8780e8cda0d086
gcp-machine-controllers git 01515888 sha256:57ab66dc83ffe558abb572a96d639792304b9f4d7262ec063afbbb2d4339ce70
gcp-pd-csi-driver git 500ab5d3 sha256:b5186060334612140807c31123629d848877fad0ef9e7847ce76b9327df5eb79
gcp-pd-csi-driver-operator git e0ad050a sha256:2d0673c94ac08c3106649c072f84254f5c422778ccb585f22ee522b3276851b3
gcp-workload-identity-federation-webhook git b36788ed sha256:44b75d6bc6eac20520b8d42022b3fd6195b257175a0239d30bde73c6461f26bd
ibm-cloud-controller-manager git 36ab30f9 sha256:2ec9a83242746b33b1ba0d8b6dbe7c21da0cfda32ab750ef1d1ea94ab06b2d10
ibm-vpc-block-csi-driver-operator git 21f405cc sha256:00b3ced6934f1172cfffdf831f09714a5d4d35c3739c2be57696a46900d6b945
ibmcloud-cluster-api-controllers git 8b6396a4 sha256:1a9eb819fb01ae60b10db2f6ac544a0c120ff9686b4e027c66d84085b344e2de
ironic-machine-os-downloader git 6c92e542 sha256:4182e8733b7a815d0ee33d06721bc6df79d89bc4686ecfdcef79456fba7eef04
ironic-static-ip-manager git fa5b8b8b sha256:07f87b3165cdb6945838697849a7740f76b4505a38b9b7c9a85d62ec87cdb298
kube-metrics-server git cfa5ee9f sha256:7bbed019da98ccaff672edf50c21e2282c09d55552129ea7da1f7ba75b6fe397
kube-rbac-proxy git b9134351 sha256:54d33b9efe0867328de774ed049be40275c0bf8fea65d4ac5b319e99e2374b0f
kube-storage-version-migrator git 0f8a4eb8 sha256:4729d46ae474a695b68fd9c0294d6d8c1aaf37ac7c0eab00792dfce6f2611e4a
metallb-frr git 3ca45c51 sha256:9c36c6e14580fc31d7b8b81df4d439f81a9b8445a7d1380050698a6ba75285e0
multus-admission-controller git fc73c803 sha256:e6b9b935c5c7b7f4cddb6ee17615502c0150c4d004173ad234ac57c88e49c58c
multus-route-override-cni git 391c1b03 sha256:950db3363c7680c108338e5a4af8acdfde0cc086d937d0207788575cdb75a6c4
multus-whereabouts-ipam-cni git 43c89591 sha256:f462af1e1a7cae30dfe322a8e74b49578b71e068ca6cf4eab49d3f89630bf855
must-gather git f0c64742 sha256:7ab8bf3959a6f1fd523e0cd7223c617db77456073edbb49b008e1174c73563e1
network-interface-bond-cni git dd3c4d0b sha256:039b2bffe2ead05ac5a1642c2fa5180fbd71e5f3af60fabf6123e61c5b71128f
network-metrics-daemon git b81340a9 sha256:12cce9fc6f33b07b12219bce5fab65582a559eff11a3baf2593eaf8e9097a56d
network-tools git 26d09174 sha256:f0b084f74f714ddddbbfe42bc08e21a11687a59ddc0867f96ebf7c288441750d
nutanix-cloud-controller-manager git b575ef15 sha256:0345736b280cea830d7fdc0b0b90715dcf1422c052481e94c80c791d47c16c9c
nutanix-machine-controllers git 3200ddef sha256:827315717377224c85aacf605fd9f2098054dc15d22a3278cc354b4cbc4b15ae
olm-catalogd git 3e2401f2 sha256:c4641fae1b6ea2bc37b21db5341484fda19a7d0884938f166f7b7dd8d15603ab
olm-operator-controller git 3e2401f2 sha256:ae8803a82f3a53439ebade6192732e843ed0a6b1ae3b51fed692d6d93b7c3ee2
openshift-apiserver git 34cb4762 sha256:6429f889a9eadbef7f5e408f3e0f3f89bc6da7f0c1ef562df82881420f898eb9
openshift-controller-manager git d9e543dd sha256:27a8784fdf2da2069f3846f0568a7f822f86b3075a241b0cdacddeacead14788
openshift-state-metrics git b04e2ef0 sha256:63a74c1df016bef5616b5c0a85656fe64aaf1bcb3634ca53d2c15aca92ce7029
openstack-resource-controller git bf0d2c88 sha256:c56f32d7add7ed23a1e9f2b9e394f1e6cc8a9822393caf152fda57843b7204bb
ovirt-csi-driver git 1db726a9 sha256:04e06173962d7e40a40ff2a482c4170d20139b67650b17f87a83d7790daa1798
powervs-cloud-controller-manager git 2424e8dd sha256:45b67b52b8a520b84d398ef8843edf069fcd579993c25e6e6ee02671fc56cfc0
powervs-machine-controllers git f011b3c7 sha256:f96beb5f031ffdcc3065ae8ad505fc5a33d0990bccbf1d50930dddac964cf49e
prometheus-alertmanager git 419f2843 sha256:9f2ec4fb7cd93c50331ffefd6ac03299f428f678970f6dda6ee6be7b78977099
prometheus-node-exporter git fa749d65 sha256:a9ed75ca0271cf2f1af7d41842bbc835bb46181e8e8915b8be01d3df2760e996
service-ca-operator git 37e0c317 sha256:1c40cec7ea0593d6caf267f2ab5549dc6070110fd8663a897b55ca87d5dfadd8
telemeter git 4c6036ee sha256:ccb324245de2001d562e47f3e4eadf9273ac32a2d35109180946a788b21b1a0f
thanos git c0951032 sha256:9db7a592c495186dbf2a8405716f60cf44dee865c77c0e3625cb5e198051e5f1
volume-data-source-validator git 0e61642f sha256:007ddc84ca61a0a7e5d37c301349cf693fa425ba40c69025ae6210ee0f9b00ad
vsphere-cloud-controller-manager git b93eb64f sha256:1dae07341e3c98a4523ff7288a406be04a71fbf0fe8800cce69de09b9648738b
vsphere-csi-driver git 61d0d00a sha256:4d63e068161c9a82abb8f1ca578870f9187b2aba715d931225681b1f183b754b
vsphere-csi-driver-operator git 5cd04d61 sha256:7be88d9a20111ad382d899e9af22b04c586c77ae34783fdb25b4e335d0b06c76
vsphere-csi-driver-syncer git 61d0d00a sha256:e2a1bfcc07ffeb496da125a1cebe483e5c1bfb9d74473edf54f1b8424f499ec3

agent-installer-api-server

OCPBUGS-81880: Prefer multipath disk in ABI disk selection #10111
OCPBUGS-70300: Prevent race in agent-installer kubeconfig generation #8707
OCPBUGS-65901: Retry incomplete cluster registration in ABI #8429
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-81641: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2070
Full changelog

agent-installer-ui

Update OWNERS file (#3657) #3657
Bump happy-dom from 20.0.2 to 20.8.9 (#3526) #3526
OCPBUGS-77793: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3582) #3582
OCPBUGS-77794: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3546) #3546
OCPBUGS-83301: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3584) #3584
Updating assisted-installer-ui-container image to be consistent with ART for 4.20 (#3458) #3458
Add support for release branches in PR workflow (#3529) #3529
Full changelog

agent-installer-utils

OCPBUGS-77238: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #224
OCPBUGS-75868: Increase Konflux build pipeline memory #247
OCPBUGS-68324: bump github.com/sirupsen/logrus to v1.9.3 #235
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-74918: adds the csi-external-resizer to the image-references #529
OCPBUGS-72563: deploy prometheus role and binding on hypershift guest #491
Full changelog

aws-kms-encryption-provider

OCPBUGS-78426: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.20 #34
Full changelog

aws-machine-controllers

OCPBUGS-72570: Fix reconciler consistency checks in Update and Exists #164
Full changelog

aws-pod-identity-webhook

OCPBUGS-74169: Fix GOTOOLCHAIN env var #212
Full changelog

azure-kms-encryption-provider

OCPBUGS-78423: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.20 #28
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-79001: [release 4.20] - Allow all instance types in the install config for GCP #10503
OCPBUGS-78694: [release-4.20]: openstack: Disable LoadBalancer in cloud config when Octavia is unavailable #10401
OCPBUGS-79665: Use correct Project ID with GCP Shared VPC #10436
OCPBUGS-80884: [release-4.20] Add c8g* to tested_instance_types_aarch64 #10437
OCPBUGS-77896: Increase size of /var/ostreecontainer mount #10365
OCPBUGS-78091: fix wavelength zone name regex #10373
OCPBUGS-77050: Update the RHCOS 4.20 bootimage metadata to 9.6.20260217-1 #10358
OCPBUGS-74674: [release-4.20] GCP: skip AI zones #10273
OCPBUGS-74551: add support for NVIDIA H100 and H200 enabled machine series #10263
OCPBUGS-66356: Update the RHCOS 4.20 bootimage metadata to 9.6.20260112-0 #10247
OCPBUGS-73681: pkg/asset/manifests/azure: save cidr blocks #10208
OCPBUGS-73785: ensure deterministic zone ordering for control plane machines #10219
OCPBUGS-71212: Increase agent-installer pre-network-manager timeout #10199
Full changelog

baremetal-operator

OCPBUGS-78745: OCPBUGS-78836: PR2774 and PR2793 backports [release-4.20] #470
Bug OCPBUGS-76546: BMO fails to start servicing despite updates to HFC spec #460
OCPBUGS-74987: Abort inspection/cleaning before powering off during deletion #453
OCPBUGS-74084: Require PreprovisioningImage for deprovisioning when cleaning is enabled #446
OCPBUGS-63538: Create a PreprovisioningImage for servicing if needed #435
Full changelog

baremetal-runtimecfg

OCPBUGS-77170: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #384
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-77170: Install subscription-manager in required images #2209
OCPBUGS-77495: Makefile: Strip debugging symbols by default #2212
OCPBUGS-77145: oc adm policy: Only initialize UserClient if built-in OAuth is enabled #2207
OCPBUGS-74969: Fix unit test failure by updating ruby version to 3.3 #2194
OCPBUGS-74965: Clear defaultNodeSelector to run on any node #2193
Full changelog

cloud-credential-operator

OCPBUGS-79368: google.golang.org/grpc v1.79.3 #994
OCPBUGS-78200: Fix infrastructure resource name filtering in watch predicate #989
OCPBUGS-74546: Resolve nil pointer exception in hasResourceTags #970
Full changelog

cluster-autoscaler

OCPBUGS-78690: allow clusterapi provider to skip paused resources #411
OCPBUGS-77506: Pick upstream commits to Fix VPA recommender concurrent access panic #407
Full changelog

cluster-baremetal-operator

OCPBUGS-81643: Allow ProvisioningCIDR for unmanaged network #585
OCPBUGS-76340: Explicitly set the ReadOnlyRootFilesystem flag to false #555
OCPBUGS-77488: Fix NO_PROXY matching for URLs with trailing dots #567
OCPBUGS-77074: Update kubebuilder tools to more latest version #559
OCPBUGS-75933: Explicitly set ReadOnlyRootFilesystem to false for machine-os-images so that SCC don’t end up enforcing it to true #552
OCPBUGS-73916: Fix DNS resolution for metal3 service endpoints by adding trailing dots #548
OCPBUGS-71203: Mount /etc/pki/ca-trust to machine-os-images & Enable runtime extraction of aarch64 images #543
Full changelog

cluster-config-api

CORENET-6431: network, virt: Graduate PreconfiguredUDNAddresses feature gate #2546
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-83507: Fix PDB unhealthyPodEvictionPolicy field name #273
Full changelog

cluster-etcd-operator

OCPBUGS-78047: Prefer to remove members where they have another healthy machine in the same failure domain index #1564
OCPBUGS-74624: Add priority field to prevent early shutdown #1508
Full changelog

cluster-ingress-operator

OCPBUGS-84132: set trustBundleName in Istio global values #1420
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-79419: : Always set service-account-jwks-uri to LB URL even with custom issuer #2078
OCPBUGS-77005: scc: restricted-v3: Fix runAsUser range #1948
OCPBUGS-74229: SCC: allow image volume type for all SCCs #2006
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83738: add /var/run/kubernetes as emptyDir #642
CNTRLPLANE-2843: chore: update OWNERS #620
OCPBUGS-74337: Add OPERATOR_IMAGE_VERSION to recovery container #604
OCPBUGS-74624: Add priority field to prevent early shutdown #586
Full changelog

cluster-monitoring-operator

OCPBUGS-74490: Include kube_pod_labels in minimal profile #2844
OCPBUGS-77272: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2835
OCPBUGS-74623: update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 #2805
Full changelog

cluster-network-operator

OCPBUGS-83821: wait for patch port to apply drop garp flows #2966
OCPBUGS-77148: Add config override for openflow-probe #2918
OCPBUGS-76349: Remove duplicated openssl parameter #2901
CORENET-6311, OCPBUGS-74139: Skip running _stackmanager for libreswan 5.3+ #2872
OCPBUGS-73365: fix(hypershift): use net.JoinHostPort for URL construction #2876
Full changelog

cluster-node-tuning-operator

OCPBUGS-78247: workloadhints: use IsVM to skip BM-only tests #1482
OCPBUGS-70349: Remove CgroupModeV1 reference from the code #1437
OCPBUGS-62721: E2E: skip SMT disabled test when L3 cache spans entire NUMA node #1404
OCPBUGS-63751: PPC: ghw: filter out namespaces dir #1421
Full changelog

cluster-storage-operator

OCPBUGS-79532: volume-data-source-validator should run on master nodes #688
OCPBUGS-75912: add vsphere permissions for checking if users is authorized to see metrics #663
OCPBUGS-70343: volume-data-source-validator must use IfNotPresent image pull policy #653
Full changelog

cluster-version-operator

OCPBUGS-74177: lib/resourcemerge/core: Reconcile ConfigMap binaryData too #1303
OCPBUGS-64828: lib/resourcemerge: Add support for hostUsers flag #1259
Full changelog

console

OCPBUGS-83495: remove dev to admin links as dev monitoring views are enabled #16173
OCPBUGS-82012: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16261
OCPBUGS-77037: Fix QueryBrowser import to use SDK path to avoid circular dependency #16222
OCPBUGS-83573: Performance improvements + AsyncComponent refactor #16300
OCPBUGS-83420: Fix resource log dropdown TypeError #16282
OCPBUGS-81678: Fix useOperatorCatalogCategories hook. #16251
OCPBUGS-81322: Migrate InstallPlan components table to PatternFly Table #16217
OCPBUGS-81439: Fix TypeError in OLS code import to console #16221
OCPBUGS-81495, OCPBUGS-81496: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16231
OCPBUGS-78295: Fix editing secrets with mixed text and binary data #16132
OCPBUGS-78366: Clean up old session cookies to prevent accumulation #16136
OCPBUGS-78839, OCPBUGS-79465, OCPBUGS-79466: apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… #16192
OCPBUGS-76951: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16029
OCPBUGS-77951: Fix infinite recursion in project access form #16117
CONSOLE-5011: migrate to yarn berry #16070
OCPBUGS-76543: Use Actions button instead of kebab menu on Subscription details page #16018
OCPBUGS-75880: Fix referenceFor parameter in SubscriptionDetailsPage #15987
OCPBUGS-74696: Bump lodash to latest #15963
OCPBUGS-74158: Do not resolve disabled catalog type extensions #15931
OCPBUGS-72417: make cloudCredentials optional so operators load when … #15901
OCPBUGS-67225: Remove unwanted semicolon from Serverless Channel and Broker list #15834
OCPBUGS-69917: There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations #15869
OCPBUGS-73775: make cloudCredentials optional so operators load when … #15918
OCPBUGS-69732: Fix Helm chart installation with CA/TLS certificates #15862
OCPBUGS-70332: Visiting Group Detail Page > RoleBindings will show error #15887
Full changelog

console-operator

OCPBUGS-77771: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1122
OCPBUGS-76267: Fix PDB blocking node drains during cluster upgrades + update donwloads deployment #1105
OCPBUGS-69960: Reset StorageVersionMigrationDegraded condition #1085
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-74890: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 #368
Full changelog

docker-builder

OCPBUGS-66991: bump buildah to 1.39.7 to fix CVE-2025-52881 #496
Full changelog

docker-registry

OCPBUGS-68327: update logrus to v1.9.1 #462
Full changelog

driver-toolkit

OCPBUGS-78783: Support ubi minimal base image #187
Full changelog

etcd

OCPBUGS-70151: 4.20 rebase 3.5.26 #358
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83720: Fix OSD ILB bug #109
OCPBUGS-77152: Fix ose gcp cloud controller manager hermetic #97
Full changelog

haproxy-router

OCPBUGS-78435: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.20 #750
OCPBUGS-78432: Updating ose-haproxy-router-base-container image to be consistent with ART for 4.20 #749
OCPBUGS-79529: Lower verbosity for parseIPList empty list logging #753
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-78993: Bump v1.33.10 to release-4.20 #2643
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2638
OCPBUGS-77476: Rebase v1.33.9 to release-4.20 #2614
OCPBUGS-76517: Bump 1.33.8 #2595
OCPBUGS-74977: UPSTREAM: 136595: raise kubelet CSI init backoff to cover ~140s DNS delays #2581
Full changelog

hypershift

OCPBUGS-83663: fix(cpo): reconcile ClusterIP private router service for ARO HCP #8140
OCPBUGS-82069: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8177
OCPBUGS-78474: Fix deadlock when changing release image during initial provisioning #7953
OCPBUGS-81746: Honor AWS AMI override in NodePool token generation #8183
OCPBUGS-80950: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8083
OCPBUGS-78979: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #8023
CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998
OCPBUGS-78741: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7976
CNTRLPLANE-2814: feat(aro): Swift support #7885
OCPBUGS-76992: fix kubevirt, use 100.66.0.0/16 for join subnet #7733
OCPBUGS-78305: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7890
OCPBUGS-76324: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7660
OCPBUGS-77366: Fix ignition-server pod restarts #7842
OCPBUGS-75931: [release-4.20] fix(cpo): Correct route labeling logic for HCP router infrastructure #7642
OCPBUGS-74105: Fix CVE-2025-58183 #7546
CNTRLPLANE-2680: Add support for setting max expiration duration for KAS service account tokens #7707
OCPBUGS-74775: feat(cpo): check components are available before setting HostedCluster available #7616
OCPBUGS-72409: fix(Portieris): Fix Portieris by mounting emptyDir to ‘./.trust’ work dir #7421
OCPBUGS-73365: fix(cno): use brackets only for IPv6 in server URL #7461
OCPBUGS-72405: Fix Konflux EC voilation, update deprecated base … #7444
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-77205: [release-4.20] standardize build paths #120
Full changelog

ibmcloud-machine-controllers

OCPBUGS-81317: bump vpc go sdk #89
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #85
Full changelog

insights-operator

OCPBUGS-82970: kubeletconfig gathere #1270
OCPBUGS-80641: Bump google.golang.org/grpc to v1.79.3 (Revamp #1261) #1267
OCPBUGS-76961: Extends the time for the extractor liveness probe #1231
OCPBUGS-74902: set Progressing condition on cluster update #1219
OCPBUGS-75114: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1222
OCPBUGS-64107: [release-4.20] Patch for GO-2025-4014 #1215
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-77566: remove dnf cache from the container images #66
Full changelog

ironic

OCPBUGS-74405: Update sushy to include DGX B200 credentials fix #820
OCPBUGS-74117: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #792
OCPBUGS-77264: fix for minimal builds #800
OCPBUGS-76539: Update ironic hash for 4.20 with heartbeat inspection fix #788
Bug OCPBUGS-76547: Bump 4.20 ironic-image to include firmware update fixes #787
OCPBUGS-69786: Bump eventlet version #756
Full changelog

ironic-agent

OCPBUGS-77264: fixes for minimal builds #244
OCPBUGS-69777: Bump eventlet version #228
Full changelog

keepalived-ipfailover

OCPBUGS-78076: openshift-enterprise-base: remove subscription-manager, dbus, systemd #227
Full changelog

kube-state-metrics

OCPBUGS-72589: fix: only close existing channels #128
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-74100: [4.20] sync upstream 2026-01-27 #62
Full changelog

kubevirt-csi-driver

OCPBUGS-79064: Add annotation-based fallback for infra VM node ID resolution #84
OCPBUGS-78371: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.20 #78
Full changelog

machine-api-operator

OCPBUGS-83394: Remove cluster-api-provider-libvirt references #1487
OCPBUGS-78424: [release-4.20] Use resource group when generating default Azure image #1475
Full changelog

machine-config-operator

OCPBUGS-84151: Allow enablement of systemd units with existing files #5873
OCPBUGS-83867: Update AMI Whitelist #5866
OCPBUGS-83393: Use HA leader election defaults for MCO on SNO #5848
OCPBUGS-80947: Skip boot image updates until cluster is stable #5812
OCPBUGS-79370: Re-order logger setting to eliminate race condition #5791
[release 4.20] OCPBUGS-77252: Calculate machine counts in MCP status from node properties #5692
OCPBUGS-79577: Update AMI Whitelist #5806
OCPBUGS-79371: set default-timeout-stop to 200s globally #5792
OCPBUGS-78049: install/0000_80_machine-config_04_kube_rbac_proxy_config: Consistent terminal newline #5753
OCPBUGS-77883: Fix failure domain matching during vsphere boot image updates #5745
OCPBUGS-77950: Update AMI Whitelist #5748
OCPBUGS-77665: Update AMI Whitelist #5731
OCPBUGS-77064: reduce MCO image size #5673
OCPBUGS-77472: Clean up vsphere login error logging #5715
OCPBUGS-77369: Remove MCD liveness probe #5707
OCPBUGS-77181: mcd_config_drift not working properly #5684
OCPBUGS-76921: Prevent unnecessary systemd unit disable #5664
OCPBUGS-77008: Machine-config controller should not log about non-existent pull-secret changes #5668
OCPBUGS-74433: Set NodeDegraded MCN condition when node state annotation is set to Degraded #5649
OCPBUGS-76339: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5631
OCPBUGS-76361: Update AMI script and list #5641
OCPBUGS-74146: enable nodeip-configuration for platform external #5580
OCPBUGS-74298: Fix up bootstrap-e2e #5590
OCPBUGS-73884: pkg/controller/container-runtime-config: admin_ack handling for 4.20-to-4.21 OCI mirror requirement #5558
OCPBUGS-73776: Fix timeout during configMap cleanup #5557
OCPBUGS-74081: Enable existing units without content #5565
OCPBUGS-66260: Set -fin timeouts in HAProxy config #5459
OCPBUGS-70201: ctrcfg: set increase ulimits when upgrading from 4.20 to 4.21 #5516
OCPBUGS-69706: Fix keepalived SIGTERM handling #5507
OCPBUGS-70322: Skip boot image updates if arch annotation is not found #5525
OCPBUGS-70349: Remove the dead code of setting the operator status for cgroupv1 based clusters #5446
Full changelog

machine-image-customization-controller

OCPBUGS-81296: Return error when network data Secret lacks nmstate key #172
OCPBUGS-77496: Clean up dnf cache to reduce container image size #165
Full changelog

machine-os-images

OCPBUGS-71203: Backport multi arch fixes #77
Full changelog

monitoring-plugin

OCPBUGS-83495: [release-4.20] feat: re enable dev console views #855
OCPBUGS-83302: [release-4.20] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #888
OCPBUGS-82440: fix: re encode params when redirecting from graph to query-browser #872
OCPBUGS-77406: bump koa #866
OCPBUGS-78359: fix for CVE-2025-69873 #846
OCPBUGS-78425: Updating monitoring-plugin-container image to be consistent with ART for 4.20 #843
OU-1062: [release-4.20] feat: mark alert menu active for incidents tab #826
OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9: Axios affected by Denial of Service via proto Key in mergeConfig #796
NO-JIRA: [release-4.20] e2e-monitoring fixing loop on legacy dashboard #830
NO-JIRA: [release-4.20] simplify dockerfile by removing cachito dependencies #807
revert #780 #792
OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig [openshift-4.20] #780
OCPBUGS-76613: [release-4.20] fix: update vulnerable dependencies #766
OCPBUGS-73842: fix: update qs vulnerable dependency #733
NO-JIRA: [release-4.20] fix: remove unnecessary package.lock #732
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-73737: Fix server url in kubeconfig #273
OCPBUGS-73888: update ci-operator.yaml #274
Full changelog

multus-networkpolicy

OCPBUGS-77548: Clean up dnf cache #102
Full changelog

networking-console-plugin

OCPBUGS-84124: Migrate to npm #387
OCPBUGS-77226: Fix NAD creation using default namespace instead of selected one #350
CNV-77540: fix Enable MultiNetworkPolicies lead to invalid URL #342
CNV-76277: Fix name generator with unprofessional names #317
Full changelog

oauth-apiserver

NO-JIRA: (chore): update OWNERS file #168
Full changelog

oauth-proxy

OCPBUGS-74132: test/e2e - do not use ambiguous container image short names #345
Full changelog

oauth-server

OCPBUGS-77500: groupmapper: avoid mutating original group users slice when removing user #214
OCPBUGS-68330: go.mod: bump logrus from v1.9.0 to v1.9.3 to fix CVE-2025-65637 #209
Full changelog

oc-mirror

OCPBUGS-77416: Fix registriesd “unknown userid” failure for arbitrary UIDs #1360
OCPBUGS-76630: Fix reg config detection for explicit false values #1350
OCPBUGS-76949: fix conversion issue for catalog #1353
OCPBUGS-75007: [release-4.20] fix duplicated channel bug in filtered catalogs #1347
Full changelog

openstack-cluster-api-controllers

OCPBUGS-64814: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 #381
Full changelog

openstack-machine-api-provider

OCPBUGS-69645: Don’t record event for every reconcile #145
OCPBUGS-76790: Fix make test #157
OCPBUGS-74226: Revendor CAPO #148
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-79681: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1267
OCPBUGS-81292: add jiazha to approvers #1269
OCPBUGS-77958: Update NetworkPolicy egress for HyperShift custom API ports #1253
OCPBUGS-77230: Remove the collect-profiles info from the microshift kustomization file #1236
OCPBUGS-76335: Remove the collect-profiles job #1223
Full changelog

operator-marketplace

OCPBUGS-77582: Update NetworkPolicy egress to support HyperShift custom API ports #730
OCPBUGS-73876: Update default catalog polling interval to 4h (240m) #708
Full changelog

ovirt-csi-driver-operator

OCPBUGS-68331: Bump github.com/sirupsen/logrus to v1.9.3 #145
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-84054: [release 4.20] virt: fix SyncVirtualMachines deleting UDN DHCP options during startup #3152
OCPBUGS-78777: Fix NAD Controller syncAll for networkID upgrade from node->NAD #3093
OCPBUGS-81477: node: fix serviceUpdateNotNeeded nil pointer comparison #3099
OCPBUGS-79537: EgressFirewall: Use exponential backoff to refresh IP addresses for DNS names #3088
OCPBUGS-77148: Minimize ACLs by combining ipBlocks into single ACL #2981
OCPBUGS-77357: Clear stale conntrack UDP entries for nodePorts #3012
OCPBUGS-77081, OCPBUGS-77094: [release-4.20] combined backport PR for 2 escalations #2985
OCPBUGS-73788: Fix service flows for BGP on IPV6 #2934
OCPBUGS-74268: release-4.20 fix(localnet, ipamless): Prevent LSP deletion on sync #2941
Full changelog

powervs-block-csi-driver

OCPBUGS-80675: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #128
OCPBUGS-82873: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #122
OCPBUGS-75818: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #113
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80676: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #108
OCPBUGS-75820: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #105
Full changelog

prom-label-proxy

OCPBUGS-84068: update to v0.12.1 #393
Full changelog

prometheus

OCPBUGS-78582: [release-4.20] chore(kubernetes): deduplicate warning logs from the API #299
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77296: backport upstream fix to reconcile resources with inconsistent status #367
OCPBUGS-77190: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #362
Full changelog

rhel-coreos, rhel-coreos-extensions

OCPBUGS-82524: post-process: Remove workaround for openvswitch additional group #1928
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-76957: filter ingress namespace on UnmanagedRoutes metric #74
Full changelog

tests

: OCPBUGS-77313: Add test for CPMS OnDelete strategy with full master replacement #30882
OCPBUGS-78193: Exclude disruption during NoExecuteTaintManager serial tests #30858
OCPBUGS-83447: Fix PinnedImages test to respect node taints #30970
: run resource request/limit check early #30888
OCPBUGS-78025: Skip oauth test for external control plane topology #30848
OCPBUGS-78084: Update optimized builds test to use rpm -qa instead of dnf #30861
OCPBUGS-78084: Allow test to tolerate running on minimal images #30853
OCPBUGS-77824: add the missing namespace from managed openshift #30837
OCPBUGS-77776: Update MCN tests to better handle condition transitions through the “Unknown” state #30829
OCPBUGS-72395: Unrevert TLS tests with fixes #30668
OCPBUGS-72412, OCPBUGS-72413: only run Netpol two at a time #30666
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78436: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 4.20 #92
Full changelog

vsphere-problem-detector

OCPBUGS-74901: fix concurrent map writes #208
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github