4.20.25

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.20.25-x86_64

Team Approvals:

Accepted
- QE

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
Informing jobs
- aws-ovn-serial-1of2 Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-serial-1of2
- aws-ovn-serial-2of2 Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-serial-2of2
- aws-ovn-single-node-upgrade-4.20-micro Succeeded periodic-ci-openshift-release-main-ci-4.20-e2e-aws-upgrade-ovn-single-node
- aws-ovn-upgrade-4.20-micro-fips Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-ovn-upgrade-fips
- azure-ovn-upgrade-4.20-micro Succeeded periodic-ci-openshift-release-main-ci-4.20-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.20-fips-payload-scan
- gcp-ovn-rt-upgrade-4.20-minor Failed (1 retry) periodic-ci-openshift-release-main-ci-4.20-upgrade-from-stable-4.19-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- hypershift-ovn-conformance-4.20 Failed (1 retry) periodic-ci-openshift-hypershift-release-4.20-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.20-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.20-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.20-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.19.18, 4.19.20, 4.19.21, 4.19.22, 4.19.24, 4.19.25, 4.19.26, 4.19.27, 4.19.28, 4.19.29, 4.19.30, 4.20.10, 4.20.11, 4.20.12, 4.20.13, 4.20.15, 4.20.16, 4.20.18, 4.20.19, 4.20.20, 4.20.21, 4.20.3, 4.20.4, 4.20.5, 4.20.6, 4.20.9

4.20.24 (changes) - S S S S S S S F S F
4.20.23 (changes) - Success Success
4.20.22 (changes) - Success Success
4.20.17 (changes) - Success Success
4.20.14 (changes) - Success Success
4.20.8 (changes) - Success Success
4.20.2 - Success Failed
4.20.1 (changes) - Success Success
4.20.0 (changes) - Success Success
4.19.34 (changes) - Success Failed
4.19.33 (changes) - F S S S S
4.19.32 (changes) - Success Success
4.19.31 (changes) - Failed Success
4.19.23 (changes) - Success Success
4.19.19 (changes) - Failed Failed
4.19.17 (changes) - Success Failed
4.19.16 (changes) - Success Success
4.19.15 (changes) - Success Success
4.19.0-0.nightly-2026-06-10-215450 (changes) - Success
4.19.0-0.nightly-2026-06-10-072402 (changes) - Failed Failed

Upgrades to:

4.21.20 (changes) - F F F S S S S S
4.21.19 (changes) - Failed

Loading changelog, this may take a while ...

Changes from 4.20.2

Created: 2026-06-11 12:20:06 +0000 UTC

Image Digest: sha256:490002f6d1363683178f4b9999f52602588f3cb75a9267a190fdfdee06e2db7a

Components

Kubectl 1.33.3
Kubernetes upgraded from 1.33.5 to 1.33.12
Kubernetes Tests 1.33.4
Red Hat Enterprise Linux CoreOS upgraded from 9.6.20251027-0 to 9.6.20260608-0

The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ExternalOIDCWithUIDAndExtraClaimMappings (5 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
PreconfiguredUDNAddresses (10 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ExternalOIDC (9 tests)	Enabled	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
GatewayAPIWithoutOLM (5 tests)

Removed images

libvirt-machine-controllers
ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

apiserver-network-proxy git 11b24a2c sha256:642a6a44c5ccb63a380ab4491670cba18ab29f9b48adbdde46a632a911d0afe7
aws-cloud-controller-manager git bb88da16 sha256:724e08d3f34801f07849363209eef8297511ed55a743c746bc95748067e4b25c
aws-cluster-api-controllers git 300439ea sha256:b9216ada1745ea932f6b4361d51379a58be4f6e16adf7067f950d5060ab4acc6
aws-karpenter-provider-aws git b37141b0 sha256:9d35fca883a52887fab497b7ec34639d7554d0f65d8212c2040aa4932f49c686
azure-workload-identity-webhook git 88b18175 sha256:f7a3cb0093398ce6d19699b1a3b1d6a94e413387bc1309c243f6388ae899ba9d
baremetal-cluster-api-controllers git f782ba74 sha256:f180e8fa577cd760756f49e26ac0cc92d6a8379d2ea554bec4b9dd10b7db714f
baremetal-machine-controllers git fb678fec sha256:e6c4164424cc04ccfc6779a33fdaf100f5176e59dcf467756e476aefa24600d7
cluster-autoscaler-operator git 147e5a7f sha256:495faf2c3c10932b6581b80a82ce5c2378cc7af2bbcd9077395cc180c204fac9
cluster-bootstrap git 74abc555 sha256:56e9f6be8d4c7fca4a5671c7277f17b98d72fb448b633c9a6e56bbc3f6cfad80
cluster-config-operator git 657754e2 sha256:075b5981a4c718ccd3b39d7040dac572111467e8330eaa85f77e01d31a304dd9
cluster-control-plane-machine-set-operator git 0bbafe24 sha256:0aae25ded8c75fbddad317bdf155eee8b794bef8ff078decc043c7f893f7032b
cluster-dns-operator git 82578923 sha256:3682dd3777404b5391b36004e96a2115ab3aa26e1e89a9095e151ec7dcba55e5
cluster-image-registry-operator git b04c7c12 sha256:2e975ad3e91e8c2a8be4493725733d615de803fef88aba0e1123ae9252e8f6e1
cluster-kube-storage-version-migrator-operator git 5adc1429 sha256:b5346034a9150762a1c16a6f1bdb2ab47a27b6781080597e6f7157e5d9b4eb09
cluster-openshift-apiserver-operator git 9cfa5679 sha256:ee540119a93dc1adda50689bc1df1430245c86d03c39d75641fb2a3925d9b0f2
cluster-openshift-controller-manager-operator git aa455c04 sha256:7f43082511839e4094b0c228cca4363bd8043d6919c4ae8451442648f21b381e
cluster-policy-controller git 47c78310 sha256:3515480c02795953610e432da25ef95e1736c4d10bed8931d0a83327646b0675
cluster-update-keys git c40e7b9b sha256:666e4eec50dcf497f156a8374f58adc22d47e8e17798da914544fbbfa6fd93ce
configmap-reloader git 2438d7c8 sha256:f9af769a21c5b0b8e7f6107fefcc02699cb0708366cd5494b93b0e6f5110e874
container-networking-plugins git 184a9601 sha256:ff6e851d3e536b5b6dbac11de39f3ec2ab53bfee1e7212311dcf57d069fc05de
containernetworking-plugins-microshift git 184a9601 sha256:24701bc5a9a6db92fdf4f0e12bd5fff8de217e155fc7afb31f641cf2cc95d4a3
coredns git 6f39336e sha256:400bcc7b178deefe8ca9754ef16b7641c22fbeb0d3005e6cce73eef2f988c442
csi-external-resizer git c674bea9 sha256:75ad3d33bebc723f868c9e5d1647342b2ce789e72da7946eeee5336972ce28b4
csi-external-snapshot-metadata git 693a8264 sha256:a09dcd1b29286ce0658ed18e1101a8a184b999a5ef0ee160de4d112ffd3693ba
csi-livenessprobe git 1d6d6b27 sha256:bb329b44698eb408a3c16fdac81fdda7c751332b4bd7826419e4fa43e11b5324
csi-node-driver-registrar git 6ce4713c sha256:85bb44222b38a8304f197eda1e5f801b2de900015bf853b438d8d9105dac1d27
egress-router-cni git 5e0f8d1b sha256:e074602584219de0b60cc110baa1becb3da18357a748677483e7b4fd832d4815
gcp-workload-identity-federation-webhook git b36788ed sha256:fcef54cef2bad23561e3fefe9143063f05e033be6fea66914b71db619a6972f4
ibm-cloud-controller-manager git 36ab30f9 sha256:6d06dffba2488178c7ba77a94d289dcb3c3067f9f94f8d9b5c536cd409d42eb1
ibm-vpc-block-csi-driver-operator git 21f405cc sha256:f88c40830c083426e6a1063a3379ba0b62b59777cfcf3299420ee9bda2770d76
ibmcloud-cluster-api-controllers git 8b6396a4 sha256:da0418548083c58a61ba06f3d926876b02e7b26574d01107ae721032f3849222
ironic-machine-os-downloader git 6c92e542 sha256:ed1e96e68a4d3aa249d65aa12b51709786f00a2900b61cba5e1569648210ebcc
ironic-static-ip-manager git fa5b8b8b sha256:f506615cf0e38f0d56e8aab10268ce659249224704d7e6a45c40d536aca588ac
kube-rbac-proxy git b9134351 sha256:fcd4f32783510721d8e1a61884428d56f44b175c8786498f13f6d554f969f1e4
kube-storage-version-migrator git 0f8a4eb8 sha256:e49110fb2f6d5ae11ad2ad489477f8f18c859851196cb123971e50d7e2b6f830
multus-admission-controller git fc73c803 sha256:139a953ca41f5f6246154ebc7af0d41a8f020f6b32037c79c7546715febd7c2e
multus-route-override-cni git 391c1b03 sha256:823e10058e3aae4e38906963fc3bf927e0c9c1ba7d7cfa2cca15faf94fa0306b
multus-whereabouts-ipam-cni git 43c89591 sha256:8d3346a2cd3ea66641b538473a0b4b93386664f001f0c4a30c0d9dfcba289b2c
network-interface-bond-cni git dd3c4d0b sha256:420c62b311c7c374ad6fcd202f2a5a6a6736f9b450e4b32878783b4bf0fea397
network-metrics-daemon git b81340a9 sha256:d79ff6bd125ad855ea6d56ac0c7657d07e3124f76326e09db5903dc2bbf049f4
network-tools git 26d09174 sha256:6faea29eae8a5514e953f25069293f584de01b81f0f13ad51c89dee06deb1ed2
nutanix-cloud-controller-manager git b575ef15 sha256:80dde4c417bb0fcca1fa3055914d186a49c8ef43d7944f321fcd82bcff96d035
nutanix-machine-controllers git 3200ddef sha256:93050f7cf171b4e7084ddd3b7a62df22645ce0ea9c12f22aaa906718201892cc
openshift-controller-manager git d9e543dd sha256:60b60646a956ed2e385c282556e46e3a52f053b1027c411d62217f4392f5e6c7
openshift-state-metrics git b04e2ef0 sha256:766ad28f8d113675af3804933d95cbfb7c60ea9c835f1b1a9c7b50f8bdb0bdd6
openstack-resource-controller git bf0d2c88 sha256:2615abf7cb6328dbd3576d415e76d80a40683d52b8c9b5d1e60e9b076df2630a
powervs-machine-controllers git f011b3c7 sha256:7522f72f8f9b056651152b30b10ec86fd45b9d43a9bf9fc44949709e8e2609c5
prometheus-alertmanager git 419f2843 sha256:84f90e7863dd7aeff99190559243a2192f74ff44ef80bfc72b4144dfec1e014e
service-ca-operator git 37e0c317 sha256:846834937fc8101ae71ac8cbb5cc1f35d37a187f6ed58d4cf7956d9d5e4e362f
volume-data-source-validator git 0e61642f sha256:64af83295ed795a86e0bf15db71b2a1ddbfa0129c9a53c2dc4e95f70b3867601
vsphere-cloud-controller-manager git b93eb64f sha256:4299ca46f2b96d29fe4eea1aa991983f624cca6aaa269872f96f5be8f9131dc2

agent-installer-api-server

OCPBUGS-81880: Mark raw FC/iSCSI multipath members as ineligible #10149
OCPBUGS-81880: Prefer multipath disk in ABI disk selection #10111
OCPBUGS-70300: Prevent race in agent-installer kubeconfig generation #8707
OCPBUGS-65901: Retry incomplete cluster registration in ABI #8429
OCPBUGS-57606: Updating ose-agent-installer-api-server-container image to be consist… #8399
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-81641: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2070
Full changelog

agent-installer-node-agent

OCPBUGS-57718: Update golang images to 1.24 for OpenShift 4.20 #1194
Full changelog

agent-installer-ui

OCPBUGS-85542: Bump msw pkg version to 2.13.5 (#3730) #3730
OCPBUGS-84606, OCPBUGS-84829, OCPBUGS-84992, OCPBUGS-85008, OCPBUGS-85010, OCPBUGS-85038: Bump axios to ^1.15.1 (#3691) #3691
Update OWNERS file (#3657) #3657
Bump happy-dom from 20.0.2 to 20.8.9 (#3526) #3526
OCPBUGS-77793: bump react-router-dom-v5-compat to ^6.30.3 to address CVE-2026-22029 (#3582) #3582
OCPBUGS-77794: upgrade lodash and lodash-es to 4.17.23 to address CVE-2025-13465 (#3546) #3546
OCPBUGS-83301: bump axios to ^1.15.0 for fixing CVE-2026-40175 (#3584) #3584
Updating assisted-installer-ui-container image to be consistent with ART for 4.20 (#3458) #3458
Add support for release branches in PR workflow (#3529) #3529
remove external platforms field from below sea level UI (#3318) #3318
Adding TechPreview Budge for Assisted installer and agent (#3296) #3296
Full changelog

agent-installer-utils

OCPBUGS-77238: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #224
OCPBUGS-75868: Increase Konflux build pipeline memory #247
OCPBUGS-68324: bump github.com/sirupsen/logrus to v1.9.3 #235
OCPBUGS-69834: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 20eb21c #208
OCPBUGS-69830: Update Konflux references #207
OCPBUGS-67306: Update Konflux release version to 4.20.8 #212
OCPBUGS-66431: Add Konflux PipelineRun params required by release pipeline #206
OCPBUGS-66425: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 13cf619 #186
OCPBUGS-66422: Update Konflux references #185
OCPBUGS-66406: Update Konflux release version to 4.20.6 #204
OCPBUGS-65715: Update 4.20 version to 4.20.4 #196
OCPBUGS-64694: Update 4.20 version to 4.20.2 #193
Full changelog

aws-ebs-csi-driver

OCPBUGS-80562: Bump google.golang.org/grpc to v1.79.3 #311
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-85573: Add init container for Manila node daemonset #553
OCPBUGS-80667: Bump google.golang.org/grpc to v1.79.3 #540
OCPBUGS-74918: adds the csi-external-resizer to the image-references #529
OCPBUGS-72563: deploy prometheus role and binding on hypershift guest #491
OCPBUGS-65895: allow all-egress for efs operator #473
OCPBUGS-65686: Bump gophercloud #470
Full changelog

aws-kms-encryption-provider

OCPBUGS-80537: Bump google.golang.org/grpc to v1.79.3 #41
OCPBUGS-78426: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.20 #34
Full changelog

aws-machine-controllers

OCPBUGS-72570: Fix reconciler consistency checks in Update and Exists #164
Full changelog

aws-pod-identity-webhook

OCPBUGS-74169: Fix GOTOOLCHAIN env var #212
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-80566, OCPBUGS-80567: Bump google.golang.org/grpc to v1.79.3 #179
Full changelog

azure-cluster-api-controllers

OCPBUGS-80568: Bump google.golang.org/grpc to v1.79.3 #384
Full changelog

azure-disk-csi-driver

OCPBUGS-80569: Bump google.golang.org/grpc to v1.79.3 #140
OCPBUGS-85054: Fix dangling detaches 420 #145
OCPBUGS-78034: add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks #128
Full changelog

azure-file-csi-driver

OCPBUGS-80572: Bump google.golang.org/grpc to v1.79.3 #128
Full changelog

azure-kms-encryption-provider

OCPBUGS-78423: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.20 #28
Full changelog

azure-machine-controllers

OCPBUGS-65708: Set updateDomainCount to one when faultDomainCount is one #173
Full changelog

azure-service-operator

OCPBUGS-80539: Bump google.golang.org/grpc to v1.79.3 #29
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-77834: Update RHCOS-release-4.20 bootimage metadata to 9.6.20260512-0 #10580
OCPBUGS-79001: [release 4.20] - Allow all instance types in the install config for GCP #10503
OCPBUGS-78694: [release-4.20]: openstack: Disable LoadBalancer in cloud config when Octavia is unavailable #10401
OCPBUGS-79665: Use correct Project ID with GCP Shared VPC #10436
OCPBUGS-80884: [release-4.20] Add c8g* to tested_instance_types_aarch64 #10437
OCPBUGS-77896: Increase size of /var/ostreecontainer mount #10365
OCPBUGS-78091: fix wavelength zone name regex #10373
OCPBUGS-77050: Update the RHCOS 4.20 bootimage metadata to 9.6.20260217-1 #10358
OCPBUGS-74674: [release-4.20] GCP: skip AI zones #10273
OCPBUGS-74551: add support for NVIDIA H100 and H200 enabled machine series #10263
OCPBUGS-66356: Update the RHCOS 4.20 bootimage metadata to 9.6.20260112-0 #10247
OCPBUGS-73681: pkg/asset/manifests/azure: save cidr blocks #10208
OCPBUGS-73785: ensure deterministic zone ordering for control plane machines #10219
OCPBUGS-71212: Increase agent-installer pre-network-manager timeout #10199
OCPBUGS-65767: Add StandardFXmdsv2Family to azure tested instance type list #10104
OCPBUGS-66231: Use separate tmpfs for ostree checkout on live ISO #10140
OCPBUGS-65763: continue to update 02_storage.json using new property storageAccountId #10103
OCPBUGS-66257: CORS-4249: bump ARO marketplace images #10142
OCPBUGS-66207, OCPBUGS-66208: Fix console info for interactive agent installer #10136
Revert “OCPBUGS-65586: Update the RHCOS 4.20 bootimage metadata to 9.6.202511…” #10093
OCPBUGS-65586: Update the RHCOS 4.20 bootimage metadata to 9.6.202511… #10084
OCPBUGS-64924: Azure UPI ARM template: use storageAccountId #10069
OCPBUGS-64595: Remove pending items on gcp no-op #10056
OCPBUGS-63633: Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 #10037
Full changelog

baremetal-operator

OCPBUGS-82008: Fix PPI for ACM #486
OCPBUGS-78745: OCPBUGS-78836: PR2774 and PR2793 backports [release-4.20] #470
Bug OCPBUGS-76546: BMO fails to start servicing despite updates to HFC spec #460
OCPBUGS-74987: Abort inspection/cleaning before powering off during deletion #453
OCPBUGS-74084: Require PreprovisioningImage for deprovisioning when cleaning is enabled #446
OCPBUGS-63538: Create a PreprovisioningImage for servicing if needed #435
OCPBUGS-69667: Change architecture default to match controller #440
Full changelog

baremetal-runtimecfg

OCPBUGS-72567: Fix TNA and TNF dummy ip for ipv6 #379
OCPBUGS-77170: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #384
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-81946: Bump go-jose/go-jose/v4 to v4.1.4 #2274
OCPBUGS-77170: Install subscription-manager in required images #2209
OCPBUGS-77495: Makefile: Strip debugging symbols by default #2212
OCPBUGS-77145: oc adm policy: Only initialize UserClient if built-in OAuth is enabled #2207
OCPBUGS-74969: Fix unit test failure by updating ruby version to 3.3 #2194
OCPBUGS-74965: Clear defaultNodeSelector to run on any node #2193
OCPBUGS-66241: Fall back to simpler behavior, if setsid,ps,pkill are not installed #2158
OCPBUGS-65481: pkg/cli/admin/upgrade: Tighten force warnings #2140
OCPBUGS-65523: fix(must-gather): do not set node affinity if nodename is set #2142
OCPBUGS-64791: Rely on overall available disk space of the mounted volume #2133
OCPBUGS-64773: oc adm must-gather: Wrap gather in a session #2132
Full changelog

cloud-credential-operator

OCPBUGS-81947: Bump go-jose/go-jose/v4@v4.1.4 #1029
OCPBUGS-79368: google.golang.org/grpc v1.79.3 #994
OCPBUGS-78200: Fix infrastructure resource name filtering in watch predicate #989
OCPBUGS-74546: Resolve nil pointer exception in hasResourceTags #970
OCPBUGS-65798: ccoctl azure: retry custom role creation on consistency errors #948
OCPBUGS-63690: ccoctl: use pagination when listing resources in aws #941
OCPBUGS-63546: ccoctl: add public-key-file flag to create-all #936
Full changelog

cloud-network-config-controller

OCPBUGS-64742: Fix capacity calculation #188
OCPBUGS-63542: Change the capacity struct from int to ptrOfInt #185
Full changelog

cluster-authentication-operator

OCPBUGS-81502: Do not return error when an IdP returns 500 during a grant check #866
OCPBUGS-66315: externaloidc: return errors when node statuses cannot be used to determine oidc state #814
OCPBUGS-61896: set appropriate rolling update settings #792
OCPBUGS-63319: (bugfix): configure status controller to remove unset versions #802
OCPBUGS-64668: Update OIDC e2e test to expect admission-time validation error of invalid CEL expression #804
Full changelog

cluster-autoscaler

OCPBUGS-78690: allow clusterapi provider to skip paused resources #411
OCPBUGS-77506: Pick upstream commits to Fix VPA recommender concurrent access panic #407
OCPBUGS-63675: update node info processors to include unschedulable nodes #391
OCPBUGS-63495: refactor cloud provider options #387
Full changelog

cluster-baremetal-operator

OCPBUGS-86555: Remove trailing dot from BMO Ironic endpoint #608
OCPBUGS-84376: Fix ironic-proxy service routing for port 6385 #593
OCPBUGS-81643: Allow ProvisioningCIDR for unmanaged network #585
OCPBUGS-76340: Explicitly set the ReadOnlyRootFilesystem flag to false #555
OCPBUGS-77488: Fix NO_PROXY matching for URLs with trailing dots #567
OCPBUGS-77074: Update kubebuilder tools to more latest version #559
OCPBUGS-75933: Explicitly set ReadOnlyRootFilesystem to false for machine-os-images so that SCC don’t end up enforcing it to true #552
OCPBUGS-73916: Fix DNS resolution for metal3 service endpoints by adding trailing dots #548
OCPBUGS-71203: Mount /etc/pki/ca-trust to machine-os-images & Enable runtime extraction of aarch64 images #543
Full changelog

cluster-capi-controllers

OCPBUGS-80577: Bump google.golang.org/grpc to v1.79.3 #289
OCPBUGS-78375: Updating ose-cluster-api-container image to be consistent with ART for 4.20 #268
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #556
OCPBUGS-80581: Bump google.golang.org/grpc to v1.79.3 #545
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63164: ccm: disable unused secure-serving port and webhook #419
Full changelog

cluster-config-api

OCPBUGS-85155: Backport GatewayAPIWithoutOLM feature gate as disabled #2871
OCPBUGS-86849: Add labelSelector to MachineSet status for scale subresource #2867
CORENET-6431: network, virt: Graduate PreconfiguredUDNAddresses feature gate #2546
OCPBUGS-66204: Introduce ClosedClientConnectionPolicy to IngressController API #2609
OCPBUGS-66135: Add HTTPKeepAliveTimeout to IngressController API #2607
OCPBUGS-64843: payload-command: remove authentication CR from hypershift payload #2573
OCPBUGS-64940: Promote BYO OIDC features #2515
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-83507: Fix PDB unhealthyPodEvictionPolicy field name #273
Full changelog

cluster-etcd-operator

OCPBUGS-85412: fix(tnf): align Pacemaker kubelet and etcd retry pacing #1616
OCPBUGS-77313: Wait for revision stability before removing etcd members #1571
OCPBUGS-78047: Prefer to remove members where they have another healthy machine in the same failure domain index #1564
OCPBUGS-74624: Add priority field to prevent early shutdown #1508
OCPBUGS-63677: Backport 1504 1514 release.420 #1516
Full changelog

cluster-ingress-operator

OCPBUGS-85130: Add PrometheusRule for Gateway API gathering #1436
OCPBUGS-84132: set trustBundleName in Istio global values #1420
NO-JIRA: Add new NID team members to OWNERS #1317
OCPBUGS-66135: Implement HTTPKeepAliveTimeout tuning option #1312
OCPBUGS-66204: Implement ClosedClientConnectionPolicy field #1314
OCPBUGS-65664: IngressOperator not exposing some metrics for degraded… #1305
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-85271: fsync static pod cert and manifest writes for crash durability #2145
OCPBUGS-85564: [4.20] operator should not override authentication config serviceAccountIssuer with the default one during the operator initialization #2152
OCPBUGS-83856: Allow setting the oauthMetadata when auth type is None #2117
OCPBUGS-79419: : Always set service-account-jwks-uri to LB URL even with custom issuer #2078
OCPBUGS-77005: scc: restricted-v3: Fix runAsUser range #1948
OCPBUGS-74229: SCC: allow image volume type for all SCCs #2006
OCPBUGS-65679: enable resource v1beta2 api if DynamicResourceAllocation is enabled #1929
OCPBUGS-62057: OpenShift cluster got degraded after rotating the kube-apiserver-service-network-signer cert #1961
OCPBUGS-64689: Add priority field to prevent early shutdown #1955
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-80588: Bump google.golang.org/grpc to v1.79.3 #75
OCPBUGS-63173: Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.20 #62
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-64684: Add priority field to prevent early shutdown #890
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-83738: add /var/run/kubernetes as emptyDir #642
CNTRLPLANE-2843: chore: update OWNERS #620
OCPBUGS-74337: Add OPERATOR_IMAGE_VERSION to recovery container #604
OCPBUGS-74624: Add priority field to prevent early shutdown #586
Full changelog

cluster-machine-approver

OCPBUGS-63587: port 9193 need to be internal and port 9194 need to have a service #280
Full changelog

cluster-monitoring-operator

OCPBUGS-86992: increase lookup interval #2947
OCPBUGS-85130: Enable Gateway API telemetry metrics #2920
OCPBUGS-74490: Include kube_pod_labels in minimal profile #2844
OCPBUGS-77272: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2835
OCPBUGS-74623: update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 #2805
OCPBUGS-67166: Add the collection of MTV migration metrics #2772
OCPBUGS-62978: add tls configuration for the monitoring plugin deployment #2718
OCPBUGS-62829: Remove cluster from non-multicluster dashboards #2701
OCPBUGS-64577: Fix KSM deny-list typo #2729
Full changelog

cluster-network-operator

OCPBUGS-84176: Handle zero-worker HyperShift clusters in daemonset rollout [4.20 backport] #2973
OCPBUGS-83821: wait for patch port to apply drop garp flows #2966
OCPBUGS-77148: Add config override for openflow-probe #2918
OCPBUGS-76349: Remove duplicated openssl parameter #2901
CORENET-6311, OCPBUGS-74139: Skip running _stackmanager for libreswan 5.3+ #2872
OCPBUGS-73365: fix(hypershift): use net.JoinHostPort for URL construction #2876
OCPBUGS-66253: Add kubevirt platform to dual-stack supported platforms #2860
OCPBUGS-66412: Fix whereabouts-token-watcher DaemonSet improvements #2850
OCPBUGS-66164: [release-4.20] CORENET-6465: Remove unneeded logging config from managed ovn-kubernetes #2838
OCPBUGS-66162: [release-4.20] CORENET-6488: Preserve custom resource requests on ovn-control-plane pods #2835
OCPBUGS-46422: Add a ValidatingAdmissionPolicy blocking ServiceCIDR changes [4.20] #2827
OCPBUGS-64733: api, l2udn: subnets must be masked #2823
Full changelog

cluster-node-tuning-operator

OCPBUGS-86815: Requeue PerformanceStatus update when status write fails #1530
OCPBUGS-82850: Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 #1532
OCPBUGS-65773: Watch MCP changes including spec and labels #1434
OCPBUGS-66364: Add support for lscpu_check TuneD built-in #1443
OCPBUGS-85372: e2e: Add irqbalance StartLimitBurst >= 100 #1513
OCPBUGS-78247: workloadhints: use IsVM to skip BM-only tests #1482
OCPBUGS-70349: Remove CgroupModeV1 reference from the code #1437
OCPBUGS-62721: E2E: skip SMT disabled test when L3 cache spans entire NUMA node #1404
OCPBUGS-63751: PPC: ghw: filter out namespaces dir #1421
OCPBUGS-64832: e2e:hugepages: changing tests to use hugepages-allocator tool #1427
OCPBUGS-64588: e2e:llc: skip test when no BM worker is found #1422
OCPBUGS-63010: E2E: Add test cases related to schedulable control plane nodes #1409
Full changelog

cluster-olm-operator

OCPBUGS-80596: Bump google.golang.org/grpc to v1.79.3 #198
Full changelog

cluster-samples-operator

OCPBUGS-63507: references to github.com/sclorg/django-ex.git now also refer to the branch #655
Full changelog

cluster-storage-operator

OCPBUGS-77519: remove oVirt code from CSO #704
OCPBUGS-86121: add Azure Disk CSI driver SA name to CredentialsRequest #702
OCPBUGS-79532: volume-data-source-validator should run on master nodes #688
OCPBUGS-75912: add vsphere permissions for checking if users is authorized to see metrics #663
OCPBUGS-70343: volume-data-source-validator must use IfNotPresent image pull policy #653
Full changelog

cluster-version-operator

OCPBUGS-79463: Implement mTLS authentication and authorization for CVO metrics endpoint #1374
OCPBUGS-74177: lib/resourcemerge/core: Reconcile ConfigMap binaryData too #1303
OCPBUGS-64828: lib/resourcemerge: Add support for hostUsers flag #1259
OCPBUGS-70180: [release-4.20] OCPBUGS-70180: Unify capitalization when comparing architectures for available updates #1281
Full changelog

console

OCPBUGS-86582: Fix macOS Option key in pod terminal #16557
OCPBUGS-86872: Fix Shipwright detail pages crashing with React error #310 #16527
OCPBUGS-87100: fix trailing quote in prometheus query #16552
OCPBUGS-77127: [release-4.20] CVE-2026-26996 Bump minimatch library #16272
NO-JIRA: enable multi-architecture yarn builds #16418
OCPBUGS-83819: Fix false positive scheduler degradation caused by user workloads #16308
OCPBUGS-85042: Remove PII from events #16402
OCPBUGS-81575: Add robots.txt policy to console #16243
OCPBUGS-78439: Backport OCPBUGS-61536: vsphere settings #16141
OCPBUGS-83495: remove dev to admin links as dev monitoring views are enabled #16173
OCPBUGS-82012: Fix VolumeSnapshot and VolumeSnapshotContent tables sorting #16261
OCPBUGS-77037: Fix QueryBrowser import to use SDK path to avoid circular dependency #16222
OCPBUGS-83573: Performance improvements + AsyncComponent refactor #16300
OCPBUGS-83420: Fix resource log dropdown TypeError #16282
OCPBUGS-81678: Fix useOperatorCatalogCategories hook. #16251
OCPBUGS-81322: Migrate InstallPlan components table to PatternFly Table #16217
OCPBUGS-81439: Fix TypeError in OLS code import to console #16221
OCPBUGS-81495, OCPBUGS-81496: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16231
OCPBUGS-78295: Fix editing secrets with mixed text and binary data #16132
OCPBUGS-78366: Clean up old session cookies to prevent accumulation #16136
OCPBUGS-78839, OCPBUGS-79465, OCPBUGS-79466: apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… #16192
OCPBUGS-76951: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16029
OCPBUGS-77951: Fix infinite recursion in project access form #16117
CONSOLE-5011: migrate to yarn berry #16070
OCPBUGS-76543: Use Actions button instead of kebab menu on Subscription details page #16018
OCPBUGS-75880: Fix referenceFor parameter in SubscriptionDetailsPage #15987
OCPBUGS-74696: Bump lodash to latest #15963
OCPBUGS-74158: Do not resolve disabled catalog type extensions #15931
OCPBUGS-72417: make cloudCredentials optional so operators load when … #15901
OCPBUGS-67225: Remove unwanted semicolon from Serverless Channel and Broker list #15834
OCPBUGS-69917: There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations #15869
OCPBUGS-73775: make cloudCredentials optional so operators load when … #15918
OCPBUGS-69732: Fix Helm chart installation with CA/TLS certificates #15862
OCPBUGS-70332: Visiting Group Detail Page > RoleBindings will show error #15887
OCPBUGS-67136: Spread operand details across 2 col #15858
OCPBUGS-66427: Update client initialization in checkPackageManifestHandler #15822
OCPBUGS-67221: Disallowed Pipelines-plugin Pipelines navigation section #15833
OCPBUGS-66248: The number of Quick Starts item is wrong #15797
OCPBUGS-66206: Sync YAML editor modal settings #15787
OCPBUGS-65900: Fix unnecessary rerenders with pod-connect #15758
OCPBUGS-61785: Add validation and type guards on healthHandler calls to prevent errors #15500
OCPBUGS-65793: OpenShift Console can only show user name instead of full name as the display name #15743
OCPBUGS-65949: Add SDK-webpack 4.20 changelogs #15768
NO-JIRA: Add SDK 4.20 changelogs #15765
OCPBUGS-65761: Preserve query string in perspective switch + remove dev console folks from reviewers #15740
OCPBUGS-64861, OCPBUGS-64863: Upgrade Helm to 3.18.5 #15705
OCPBUGS-64702: Lack Chinese/Japanese/Korean translations for ‘On/Off’ switch button on editor setting modal of yaml page. #15683
OCPBUGS-63125: use tenancy path for project scoped status card #15608
OCPBUGS-61330: fix namespace path generation for non-namespaced resources #15498
OCPBUGS-62953: Automatically redirect all-namespaces catalog to default namespace #15640
OCPBUGS-64862: Convert standalone terminal route to extension #15702
OCPBUGS-63499: Turn on fContentSecurityPolicyEnabled by default #15639
OCPBUGS-64639: HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … #15673
OCPBUGS-63616: Preserve path on perspective switch #15650
OCPBUGS-64809: Never allow OTHER_CATEGORY in categories #15690
OCPBUGS-63608: Fix catalog search relevance scoring, so that operators with attribute.keywords are displayed and remove unnecessary metadataName from calculation #15648
Full changelog

console-operator

OCPBUGS-84254: Redeploy console pods upon cert rotation #1142
OCPBUGS-77771: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1122
OCPBUGS-76267: Fix PDB blocking node drains during cluster upgrades + update donwloads deployment #1105
OCPBUGS-69960: Reset StorageVersionMigrationDegraded condition #1085
OCPBUGS-69654: Update path for browsing catalogs and operators in quickstarts. #1083
OCPBUGS-64602: Remove v1alpha1 ConsolePlugin version from CRDs status #1060
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-80668: bump google.golang.org/grpc@v1.79.3 #385
OCPBUGS-74890: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 #368
OCPBUGS-64811: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 #355
Full changelog

csi-driver-nfs

OCPBUGS-80610: CVE-2026-33186: bump google.golang.org/grpc v1.79.3 #177
Full changelog

csi-external-attacher

OCPBUGS-80611: Bump google.golang.org/grpc to v1.79.3 #103
Full changelog

csi-external-provisioner

OCPBUGS-80612: Bump google.golang.org/grpc to v1.79.3 #128
Full changelog

csi-external-snapshotter, csi-snapshot-controller

OCPBUGS-80615, OCPBUGS-80618: Bump google.golang.org/grpc to v1.79.3 #209
Full changelog

docker-builder

OCPBUGS-66991: bump buildah to 1.39.7 to fix CVE-2025-52881 #496
OCPBUGS-64857: BuildConfig inline Dockerfile fails with heredoc syntax #483
Full changelog

docker-registry

OCPBUGS-68327: update logrus to v1.9.1 #462
Full changelog

driver-toolkit

OCPBUGS-78783: Support ubi minimal base image #187
Full changelog

etcd

OCPBUGS-70151: 4.20 rebase 3.5.26 #358
OCPBUGS-63474: 4.20 rebase 3.5.24 #347
Full changelog

gcp-cloud-controller-manager

OCPBUGS-83720: Fix OSD ILB bug #109
OCPBUGS-77152: Fix ose gcp cloud controller manager hermetic #97
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80628: Bump google.golang.org/grpc to v1.79.3 #288
Full changelog

gcp-machine-controllers

OCPBUGS-80651: Bump google.golang.org/grpc to v1.79.3 #163
Full changelog

gcp-pd-csi-driver

OCPBUGS-80632: Bump google.golang.org/grpc to v1.79.3 in release 4.20 #103
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-80631: Bump google.golang.org/grpc to v1.79.3 #185
Full changelog

haproxy-router

OCPBUGS-80633: Bump google.golang.org/grpc to v1.79.3 #766
OCPBUGS-78435: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.20 #750
OCPBUGS-78432: Updating ose-haproxy-router-base-container image to be consistent with ART for 4.20 #749
OCPBUGS-79529: Lower verbosity for parseIPList empty list logging #753
OCPBUGS-66204: Add option abortonclose to HAProxy configuration template #695
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-87173: fix flake race in VAP e2e case #2679
OCPBUGS-85501: Bump Kubernetes v1.33.12 to release-4.20 #2666
“OCPBUGS-83609: Bump to k8s v1.33.11” #2648
OCPBUGS-78993: Bump v1.33.10 to release-4.20 #2643
NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2638
OCPBUGS-77476: Rebase v1.33.9 to release-4.20 #2614
OCPBUGS-76517: Bump 1.33.8 #2595
OCPBUGS-74977: UPSTREAM: 136595: raise kubelet CSI init backoff to cover ~140s DNS delays #2581
OCPBUGS-61843: UPSTREAM: 131850: cpumanager: uncorecache alignment for odd integer cpus #2498
OCPBUGS-65551: Bump 1.33.6 #2518
OCPBUGS-46422: Remove patch/update from ServiceCIDR API conformance test #2466
NO-JIRA: enable CBOR tests #2502
Full changelog

hypershift

NO-JIRA: remove path filter from control-plane-operator pipelines #8666
OCPBUGS-86573: [release-4.20] add CP pull-secret watches for in-place propagation #8596
OCPBUGS-86567: fix Konflux application label for CPO 4.20 pipelines #8603
OCPBUGS-86567: [release-4.20] set limits for aro.openshift.io/swift-nic in request overrides for ARO swift #8593
OCPBUGS-83711: fix(kubevirt): filter link-local addresses from EndpointSlice endpoints #8271
OCPBUGS-85622: fix CVE-2026-33186 by updating grpc-go #8517
OCPBUGS-77109: Add UserAgent telemetry to CPO Azure SDK clients #8374
OCPBUGS-83663: fix(cpo): reconcile ClusterIP private router service for ARO HCP #8140
OCPBUGS-82069: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8177
OCPBUGS-78474: Fix deadlock when changing release image during initial provisioning #7953
OCPBUGS-81746: Honor AWS AMI override in NodePool token generation #8183
OCPBUGS-80950: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8083
OCPBUGS-78979: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #8023
CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998
OCPBUGS-78741: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7976
CNTRLPLANE-2814: feat(aro): Swift support #7885
OCPBUGS-76992: fix kubevirt, use 100.66.0.0/16 for join subnet #7733
OCPBUGS-78305: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7890
OCPBUGS-76324: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7660
OCPBUGS-77366: Fix ignition-server pod restarts #7842
OCPBUGS-75931: [release-4.20] fix(cpo): Correct route labeling logic for HCP router infrastructure #7642
OCPBUGS-74105: Fix CVE-2025-58183 #7546
CNTRLPLANE-2680: Add support for setting max expiration duration for KAS service account tokens #7707
OCPBUGS-74775: feat(cpo): check components are available before setting HostedCluster available #7616
OCPBUGS-72409: fix(Portieris): Fix Portieris by mounting emptyDir to ‘./.trust’ work dir #7421
OCPBUGS-73365: fix(cno): use brackets only for IPv6 in server URL #7461
OCPBUGS-72405: Fix Konflux EC voilation, update deprecated base … #7444
OCPBUGS-66409: test: Fix control plane components rollout failure when NetworkType is not OVNKubernetes #7337
CNTRLPLANE-2205: fix(hcco): allow for ARN reuse across components #7383
OCPBUGS-69378: test: remove network-dependent unit tests for image metadata #7391
OCPBUGS-66397: fix(kas): apply LoadBalancerSourceRanges only for LoadBalancer service type #7336
NO-JIRA: Update expected digest for busybox:latest in TestGetDigest #7350
CNTRLPLANE-1710: feat(globalps): security enhancements on GlobalPullSecret feature #7234
OCPBUGS-65576: add hypershift-no-cgo to the latest operator conta… #7229
CORENET-6484: Restart ovnkube-control-plane pods when restart-date annotation is set #7190
OCPBUGS-63509: fix(ingress): add LoadBalancerSourceRanges support for external router service #7098
OCPBUGS-64848: feat: Promote ExternalOIDCWithUIDAndExtraClaimMappings feature to GA for Hypershift #7204
OCPBUGS-61774: fix(capi-provider): use single replica deployment for aws and azure #6834
CNTRLPLANE-1908: control-plane-operator-4-20 Konflux pipelines #7216
OCPBUGS-63539: remove NTO Service and ServiceMonitor #7099
OCPBUGS-63718: specify SCC annotation for pods in data plane #7132
OCPBUGS-63128: resolve initContainer permission issue after node reboot #7080
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80638: Bump google.golang.org/grpc to v1.79.3 #141
OCPBUGS-77205: [release-4.20] standardize build paths #120
Full changelog

ibmcloud-machine-controllers

OCPBUGS-81317: bump vpc go sdk #89
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #85
Full changelog

insights-operator

OCPBUGS-86948: add config option to disable runtime extractor #1298
OCPBUGS-86235: [release-4.20] Add OpenTelemetry CR Gatherer #1293
OCPBUGS-82970: kubeletconfig gathere #1270
OCPBUGS-80641: Bump google.golang.org/grpc to v1.79.3 (Revamp #1261) #1267
OCPBUGS-76961: Extends the time for the extractor liveness probe #1231
OCPBUGS-74902: set Progressing condition on cluster update #1219
OCPBUGS-75114: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1222
OCPBUGS-64107: [release-4.20] Patch for GO-2025-4014 #1215
OCPBUGS-66062: Add filtering to add other possible pod status to QEMU gatherer #1185
OCPBUGS-64800: QEMU logs are not gathered if there are pending status virt-launcher pods #1174
OCPBUGS-65660: [bugfix] The archive’s records may include files whose names are out of bounds #1177
Full changelog

insights-runtime-exporter, insights-runtime-extractor

OCPBUGS-77566: remove dnf cache from the container images #66
Full changelog

ironic

OCPBUGS-84854: Bump pyasn to 0.5.1-5 #824
OCPBUGS-82299: Bump sushy hash to include Supermicro ARS-111GL-NHR fix #841
OCPBUGS-74405: Update sushy to include DGX B200 credentials fix #820
OCPBUGS-74117: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #792
OCPBUGS-77264: fix for minimal builds #800
OCPBUGS-76539: Update ironic hash for 4.20 with heartbeat inspection fix #788
Bug OCPBUGS-76547: Bump 4.20 ironic-image to include firmware update fixes #787
OCPBUGS-69786: Bump eventlet version #756
METAL-1695: OKD: install Ironic from the OpenShift fork #740
OKD-304: Fix python dependencies for OKD #731
OCPBUGS-64850: Handle HTTP 400 and 409 race condition in Redfish power operations #720
OCPBUGS-64820: Fix IPA external inspection callback url override #713
Full changelog

ironic-agent

OCPBUGS-77264: fixes for minimal builds #244
OCPBUGS-69777: Bump eventlet version #228
OCPBUGS-66934: Filter out more USB network devices #221
OCPBUGS-66084, OKD-295: Fix broken OKD ironic-agent-image #216
OCPBUGS-65519: Include Test advertised ip reachability before assigning it #212
Full changelog

keepalived-ipfailover

OCPBUGS-78076: openshift-enterprise-base: remove subscription-manager, dbus, systemd #227
Full changelog

kube-metrics-server

OCPBUGS-80542: Bump google.golang.org/grpc to v1.79.3 #62
Full changelog

kube-state-metrics

Fix for OCPBUGS-81951: CVE-2026-34986 bump github.com/go-jose/go-jose/v4 #144
OCPBUGS-80646: Bump google.golang.org/grpc to v1.79.3 #139
OCPBUGS-72589: fix: only close existing channels #128
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-74100: [4.20] sync upstream 2026-01-27 #62
Full changelog

kubevirt-csi-driver

OCPBUGS-79064: Add annotation-based fallback for infra VM node ID resolution #84
OCPBUGS-78371: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.20 #78
Full changelog

machine-api-operator

OCPBUGS-86849: Populate status label selector for scale subresource #1504
OCPBUGS-83394: Remove cluster-api-provider-libvirt references #1487
OCPBUGS-78424: [release-4.20] Use resource group when generating default Azure image #1475
Full changelog

machine-config-operator

OCPBUGS-86987: Update AMI Whitelist #6132
OCPBUGS-83862: Generate autosizing-disabled machineconfig only for master and worker nodes on OCP 4.20 #5885
OCPBUGS-81953: Fix CVE-2026-34986 #6033
OCPBUGS-86577: Fix re-cordon detection #6086
OCPBUGS-86134: use --delete-if-present for karg removal #6063
OCPBUGS-86313: Apply password only if changes exist #6075
OCPBUGS-86032: Add terminationMessagePolicy to build pod containers #6057
OCPBUGS-85078: Fix ssh and password rollbacks #6002
OCPBUGS-85336: Fix units rollback if update failure #6022
OCPBUGS-85069: Fix encapsulated IGN version #6001
OCPBUGS-84962: Update AMI Whitelist #5991
OCPBUGS-84890: improve JSON unmarshalling for secret decoding #5916
OCPBUGS-84151: Allow enablement of systemd units with existing files #5873
OCPBUGS-83867: Update AMI Whitelist #5866
OCPBUGS-83393: Use HA leader election defaults for MCO on SNO #5848
OCPBUGS-80947: Skip boot image updates until cluster is stable #5812
OCPBUGS-79370: Re-order logger setting to eliminate race condition #5791
[release 4.20] OCPBUGS-77252: Calculate machine counts in MCP status from node properties #5692
OCPBUGS-79577: Update AMI Whitelist #5806
OCPBUGS-79371: set default-timeout-stop to 200s globally #5792
OCPBUGS-78049: install/0000_80_machine-config_04_kube_rbac_proxy_config: Consistent terminal newline #5753
OCPBUGS-77883: Fix failure domain matching during vsphere boot image updates #5745
OCPBUGS-77950: Update AMI Whitelist #5748
OCPBUGS-77665: Update AMI Whitelist #5731
OCPBUGS-77064: reduce MCO image size #5673
OCPBUGS-77472: Clean up vsphere login error logging #5715
OCPBUGS-77369: Remove MCD liveness probe #5707
OCPBUGS-77181: mcd_config_drift not working properly #5684
OCPBUGS-76921: Prevent unnecessary systemd unit disable #5664
OCPBUGS-77008: Machine-config controller should not log about non-existent pull-secret changes #5668
OCPBUGS-74433: Set NodeDegraded MCN condition when node state annotation is set to Degraded #5649
OCPBUGS-76339: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5631
OCPBUGS-76361: Update AMI script and list #5641
OCPBUGS-74146: enable nodeip-configuration for platform external #5580
OCPBUGS-74298: Fix up bootstrap-e2e #5590
OCPBUGS-73884: pkg/controller/container-runtime-config: admin_ack handling for 4.20-to-4.21 OCI mirror requirement #5558
OCPBUGS-73776: Fix timeout during configMap cleanup #5557
OCPBUGS-74081: Enable existing units without content #5565
OCPBUGS-66260: Set -fin timeouts in HAProxy config #5459
OCPBUGS-70201: ctrcfg: set increase ulimits when upgrading from 4.20 to 4.21 #5516
OCPBUGS-69706: Fix keepalived SIGTERM handling #5507
OCPBUGS-70322: Skip boot image updates if arch annotation is not found #5525
OCPBUGS-70349: Remove the dead code of setting the operator status for cgroupv1 based clusters #5446
OCPBUGS-69666: Remove log exposing kubeconfig #5505
OCPBUGS-69444: MCP is not correctly degraded when a pivotError happens #5503
OCPBUGS-65545, OCPBUGS-67007: cherry pick to few fixes that needed for missing services and configuration #5480
OCPBUGS-67137: Fix cleanup in TestInstallRPMAndCheckMCDMetrics to decrease risk of test failures due to interference #5478
OKD-294: Migrate runtime from runc to crun on an upgrade for OKD #5467
OCPBUGS-65898: fixes systemd unit creation for empty units #5437
OCPBUGS-64822: block upgrades for conflict non-default ClusterImagePolicy resources #5414
OCPBUGS-65777: Enforce OCP 4.20 and earlier cluster to have AutoSizingReserved disabled by default #5387
OCPBUGS-65781: Remove –mount directives #5425
OCPBUGS-65556: [release-4.20] Backport: Add delays to reduce TestOSBuildController failures #5396
OCPBUGS-64822: remove check for conflicting ClusterImagePolicy in syncUpgradeableStatus #5413
OCPBUGS-65509: e2e gcp ocl PR backport #5407
OCPBUGS-64822: Implement upgrade blocking for conflicting ClusterImagePolicy named “openshift” #5397
OCPBUGS-59766: Update timing of MCN desired config spec update to align with node annotation setting #5367
OCPBUGS-64656: Update the OCP base image in Dockerfile to 4.20 reference #5392
OCPBUGS-63534: Create temporal allow policy #5373
Full changelog

machine-image-customization-controller

OCPBUGS-81296: Return error when network data Secret lacks nmstate key #172
OCPBUGS-77496: Clean up dnf cache to reduce container image size #165
Full changelog

machine-os-images

OCPBUGS-85480: Force rebuild for OCP 4.20 #94
OCPBUGS-85480: Force rebuild for OCP 4.20 #86
OCPBUGS-71203: Backport multi arch fixes #77
Full changelog

metallb-frr

OCPBUGS-65516: [release-4.20] Dockerfile: unpin FRR rpm #111
Full changelog

monitoring-plugin

OCPBUGS-79456: immutable bump: fix for CVE-2026-29063 [4.20] #951
OU-1371: reset queries when namespace changes in dev perspective #945
OU-1369: prevent namespace and project desync #941
OCPBUGS-83495: [release-4.20] feat: re enable dev console views #855
OCPBUGS-83302: [release-4.20] openshift4/ose-monitoring-plugin-rhel9: Axios: Remote Code Execution via Prototype Pollution escalation #888
OCPBUGS-82440: fix: re encode params when redirecting from graph to query-browser #872
OCPBUGS-77406: bump koa #866
OCPBUGS-78359: fix for CVE-2025-69873 #846
OCPBUGS-78425: Updating monitoring-plugin-container image to be consistent with ART for 4.20 #843
OU-1062: [release-4.20] feat: mark alert menu active for incidents tab #826
OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9: Axios affected by Denial of Service via proto Key in mergeConfig #796
NO-JIRA: [release-4.20] e2e-monitoring fixing loop on legacy dashboard #830
NO-JIRA: [release-4.20] simplify dockerfile by removing cachito dependencies #807
revert #780 #792
OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig [openshift-4.20] #780
OCPBUGS-76613: [release-4.20] fix: update vulnerable dependencies #766
OCPBUGS-73842: fix: update qs vulnerable dependency #733
NO-JIRA: [release-4.20] fix: remove unnecessary package.lock #732
OU-1146: remove random multiplication #704
OU-1135: [release-4.20] monitoring testing backport #700
OCPBUGS-69725: [release-4.20] fix: upgrade node-forge vulnerable dependency #701
OU-1130: Merge main to release 4.20 #683
OCPBUGS-66389: Time range and Refresh interval dropdown button lack of unique identifier #668
OCPBUGS-66240: configure max TLS version only when specified #664
OCPBUGS-65947: add missing conversion units #654
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-73737: Fix server url in kubeconfig #273
OCPBUGS-73888: update ci-operator.yaml #274
Full changelog

multus-networkpolicy

OCPBUGS-77548: Clean up dnf cache #102
Full changelog

must-gather

OCPBUGS-85488: Collect object size with the object count #545
Full changelog

networking-console-plugin

OCPBUGS-81615: Fix CVE-2026-CVE-2026-4800 in lodash #399
OCPBUGS-83386: Fix CVE-2026-34043 in serialize-javascript #394
OCPBUGS-84124: Migrate to npm #387
OCPBUGS-77226: Fix NAD creation using default namespace instead of selected one #350
CNV-77540: fix Enable MultiNetworkPolicies lead to invalid URL #342
CNV-76277: Fix name generator with unprofessional names #317
CNV-72230: fix networking links #308
OCPBUGS-66335: fix flickerying in synced editor #304
CNV-72771: fix null error #300
CNV-71965: replacing the broken link to VirtualMachine network docs #298
Hide VirtualMachine networks page in 4.20 release #290
Full changelog

oauth-apiserver

NO-JIRA: (chore): update OWNERS file #168
Full changelog

oauth-proxy

OCPBUGS-74132: test/e2e - do not use ambiguous container image short names #345
Full changelog

oauth-server

OCPBUGS-81813: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #236
OCPBUGS-77500: groupmapper: avoid mutating original group users slice when removing user #214
OCPBUGS-68330: go.mod: bump logrus from v1.9.0 to v1.9.3 to fix CVE-2025-65637 #209
Full changelog

oc-mirror

OCPBUGS-84064: Remove status field from CatalogSource, ClusterCatalog… #1392
OCPBUGS-85204: update integration test Dockerfile #1393
OCPBUGS-77416: Fix registriesd “unknown userid” failure for arbitrary UIDs #1360
OCPBUGS-76630: Fix reg config detection for explicit false values #1350
OCPBUGS-76949: fix conversion issue for catalog #1353
OCPBUGS-75007: [release-4.20] fix duplicated channel bug in filtered catalogs #1347
OCPBUGS-64647: fix: return only requested version #1306
OCPBUGS-65787: Remove empty status field from generated IDMS/ITMS files #1313
OCPBUGS-63030: removes unintended exec permissions #1291
Full changelog

olm-catalogd, olm-operator-controller

OCPBUGS-86968: catalogd: clean up orphaned temp dirs in catalog storage #744
OCPBUGS-80662, OCPBUGS-80663: Bump google.golang.org/grpc to v1.79.3 #727
OCPBUGS-81956, OCPBUGS-81957: Bump github.com/go-jose/go-jose/v4@4.1.1 to 4.1.4 #719
Full changelog

openshift-apiserver

OCPBUGS-65848: Add ValidatingAdmissionPolicy and check for omissions next time. #577
OCPBUGS-61982: pkg/image: conditionally parse raw image manifest #559
OCPBUGS-65814: update pkg/image/OWNERS #575
Full changelog

openstack-cluster-api-controllers

UPSTREAM-SYNC: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 #392
OCPBUGS-64814: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 #381
OCPBUGS-64814: Fix verify step #389
Full changelog

openstack-machine-api-provider

OCPBUGS-69645: Don’t record event for every reconcile #145
OCPBUGS-76790: Fix make test #157
OCPBUGS-74226: Revendor CAPO #148
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-80670, OCPBUGS-80671, OCPBUGS-80672: Bump google.golang.org/grpc to v1.79.3 for CVE-2026-33186[Release-4.20] #1293
OCPBUGS-81958, OCPBUGS-81959, OCPBUGS-81960: Bump github.com/go-jose/go-jose/v4 to v4.1.4 #1295
OCPBUGS-79681: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1267
OCPBUGS-81292: add jiazha to approvers #1269
OCPBUGS-77958: Update NetworkPolicy egress for HyperShift custom API ports #1253
OCPBUGS-77230: Remove the collect-profiles info from the microshift kustomization file #1236
OCPBUGS-76335: Remove the collect-profiles job #1223
OCPBUGS-62014: rorfs for cacheless lacks write access to /tmp/ to generate cache #1170
OCPBUGS-64724: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1139
Full changelog

operator-marketplace

OCPBUGS-77582: Update NetworkPolicy egress to support HyperShift custom API ports #730
OCPBUGS-73876: Update default catalog polling interval to 4h (240m) #708
OCPBUGS-65680: enforce client side auth requirement for metrics endpoint #688
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-76473: Remove forced V(5) logging during startup #2919
OCPBUGS-72401, OCPBUGS-72402: manual backport bug fixes #2927
OCPBUGS-81484: CUDN: cleanup NADs in terminating namespaces without pods #3102
OCPBUGS-74395: kubevirt, Use pod network subnet gateway IP for DHCP router option #3070
OCPBUGS-82115: egressip: Skip bridge configuration for secondary network IPs #3120
OCPBUGS-84054: [release 4.20] virt: fix SyncVirtualMachines deleting UDN DHCP options during startup #3152
OCPBUGS-78777: Fix NAD Controller syncAll for networkID upgrade from node->NAD #3093
OCPBUGS-81477: node: fix serviceUpdateNotNeeded nil pointer comparison #3099
OCPBUGS-79537: EgressFirewall: Use exponential backoff to refresh IP addresses for DNS names #3088
OCPBUGS-77148: Minimize ACLs by combining ipBlocks into single ACL #2981
OCPBUGS-77357: Clear stale conntrack UDP entries for nodePorts #3012
OCPBUGS-77081, OCPBUGS-77094: [release-4.20] combined backport PR for 2 escalations #2985
OCPBUGS-73788: Fix service flows for BGP on IPV6 #2934
OCPBUGS-74268: release-4.20 fix(localnet, ipamless): Prevent LSP deletion on sync #2941
OCPBUGS-66049: Fix conntrack reconciliation to use service port instead of endpoint port #2874
OCPBUGS-64836: back-port IP & MAC conflict detection #2827
OCPBUGS-65514: [4.20] status manager: remove managedFields for deleted zone upon zone deletion #2855
OCPBUGS-65951: [release-4.20]: Fix linter issues, add missing cheryy-pick bits of #2844 #2866
OCPBUGS-65618: [release-4.20] OCP4: 4.18.22 EgressIP Failover does not succeed - extended downtime and no reassignment between egress-capable peers #2865
OCPBUGS-65605: add lint target to run golanci natively #2856
OCPBUGS-64697: [release-4.20] Referencing pod named ports within a service results in bad DNAT rules containing tcp/0 target port #2844
OCPBUGS-63686: Fix stale EIP assignments during failover and controller restart #2835
OCPBUGS-64590: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2841
OCPBUGS-63696: Fixes OF flows to be VLAN aware as well as add DPU checks for certain features #2837
OCPBUGS-63007: kubevirt: fix bad release of IPs of live migratable pods #2801
OCPBUGS-63577: [release-4.20] CORENET-6055: Dockerfile: Unpin OVN and consume the latest from FDP. #2808
OCPBUGS-63631: Skip Pending pods in EgressIP status updates #2831
Full changelog

powervs-block-csi-driver

OCPBUGS-80675: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #128
OCPBUGS-82873: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #122
OCPBUGS-75818: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #113
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80676: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #108
OCPBUGS-75820: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #105
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80677: bump google.golang.org/grpc to v1.79.3 #97
Full changelog

prom-label-proxy

OCPBUGS-84068: update to v0.12.1 #393
Full changelog

prometheus

OCPBUGS-80678: Bump google.golang.org/grpc to v1.79.3 #319
OCPBUGS-86251: fix: TLS client cert rotation when no CA is configured #315
OCPBUGS-78582: [release-4.20] chore(kubernetes): deduplicate warning logs from the API #299
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

OCPBUGS-77296: backport upstream fix to reconcile resources with inconsistent status #367
OCPBUGS-77190: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #362
Full changelog

prometheus-node-exporter

OCPBUGS-63624: bump github.com/prometheus/procfs to v0.16.1 #173
Full changelog

rhel-coreos, rhel-coreos-extensions

NO-JIRA: rhaos-pkgs-match-openshift: exclude known package mismatches #1920
OCPBUGS-82524: post-process: Remove workaround for openvswitch additional group #1928
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

route-controller-manager

OCPBUGS-80554: Bump google.golang.org/grpc to v1.79.3 #83
OCPBUGS-76957: filter ingress namespace on UnmanagedRoutes metric #74
Full changelog

telemeter

OCPBUGS-80691: Bump google.golang.org/grpc to v1.79.3 #590
OCPBUGS-81814: [release-1.20] Fix CVE-2026-34986 #594
Full changelog

tests

OCPBUGS-85155, OCPBUGS-87207: Enable Gateway API tests on vSphere and baremetal #31262
OCPBUGS-87902: tests: authorization/rbac: Add restricted-v3 scc #30502
: OCPBUGS-77313: Add test for CPMS OnDelete strategy with full master replacement #30882
OCPBUGS-78193: Exclude disruption during NoExecuteTaintManager serial tests #30858
OCPBUGS-83447: Fix PinnedImages test to respect node taints #30970
: run resource request/limit check early #30888
OCPBUGS-78025: Skip oauth test for external control plane topology #30848
OCPBUGS-78084: Update optimized builds test to use rpm -qa instead of dnf #30861
OCPBUGS-78084: Allow test to tolerate running on minimal images #30853
OCPBUGS-77824: add the missing namespace from managed openshift #30837
OCPBUGS-77776: Update MCN tests to better handle condition transitions through the “Unknown” state #30829
OCPBUGS-72395: Unrevert TLS tests with fixes #30668
OCPBUGS-72412, OCPBUGS-72413: only run Netpol two at a time #30666
OCPBUGS-69686: BeforeEach was indirectly called in DetermineReleasePayloadImage #30620
OCPBUGS-66072: [release-4.20] net(virt) remove virtctl if not correctly retrieved #30538
OCPBUGS-64836: back-port IP & MAC conflict detection e2e tests #30414
OCPBUGS-66963: Fix MachineConfigNode test in two-node fencing clusters #30540
OCPBUGS-66365: update watch request limits for marketplace-operator #30569
OCPBUGS-66979: Revert “OCPNODE-3912: Add a test for NodeSizing default change to OCP 4.20” #30582
OCPNODE-3912: Add a test for NodeSizing default change to OCP 4.20 #30467
OCPBUGS-64777: [release-4.20] Add e2e tests for storage network policy #30468
OCPBUGS-46422: Add test that the ServiceCIDR API is blocked [4.20] #30434
OCPBUGS-63656: Redact bearertoken in TestContext #30435
OCPBUGS-64598: Updated the upgrade duration limit to 100 minutes for ppc64le #30451
OCPBUGS-64593: [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support #30415
OCPBUGS-63725: CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift #30439
Full changelog

thanos

OCPBUGS-80693: Bump google.golang.org/grpc to v1.79.3 #182
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-80698: Bump google.golang.org/grpc to v1.79.3 #109
OCPBUGS-78436: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 4.20 #92
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-80701: Bump google.golang.org/grpc to v1.79.3 #174
Full changelog

vsphere-csi-driver-operator

”[release-4.20] OCPBUGS-84891: Fix escaping password” #340
Full changelog

vsphere-problem-detector

OCPBUGS-74901: fix concurrent map writes #208
OCPBUGS-65795: Fixed logic for vSphere compute cluster permission #197
Full changelog

Node Image Info

Loading node image info, this may take a while ...

Unable to show node image info: too many concurrent oc adm release info --rpmdb/--rpmdb-diff operations (limit 16)

View changelog in Markdown or change previous release:

Source code for this page located on github