# 4.20.3

Created: 2025-11-06 16:03:42 +0000 UTC

Image Digest: `sha256:9c9e302e2eca08357d917e315a54dbc96c2546a6de22e3ba74bce1abca6eaf23`


## Changes from 4.20.2

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.5
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20251027-0 to 9.6.20251105-0


### Rebuilt images without code change

* [agent-installer-api-server](https://github.com/openshift/assisted-service) git [4b116f46](https://github.com/openshift/assisted-service/commit/4b116f46ca39a4933cab5647e5db44432c752b80) `sha256:2697bb02e9530fcda8c0beb540cbb833cded4077f66b42a54f07b741e2859cac`
* [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent) git [62dc63f1](https://github.com/openshift/assisted-installer-agent/commit/62dc63f18f2c4a6a0cf1043710d055fe57f8fa28) `sha256:441af724c156990103c112bd7190e632f25f3e8e3817d6b33b81eb6e8510165f`
* [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure) git [b1cb6432](https://github.com/openshift/machine-api-provider-azure/commit/b1cb6432a0ae47248e126d32fb6012eb1408e833) `sha256:09ae49f8cea976d79d8f121e0d0f386bde91adc02293a436c93e7b90f8513f34`
* [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator) git [0d7067cb](https://github.com/openshift/cluster-etcd-operator/commit/0d7067cb286ad4efad5cad9bcff17656ef9827a3) `sha256:a8252388c63ff616080dce013e5e56963e7698b66f0c3c8931a5e41511d08a64`
* [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator) git [56b12e27](https://github.com/openshift/cluster-node-tuning-operator/commit/56b12e277eec356e330a9f7dac4373a1faf52af2) `sha256:73ceec39a938d0a0408ee588762317ef215c4a6b7b8d1fb7f76300b7e6734712`
* [docker-builder](https://github.com/openshift/builder) git [ff595e4b](https://github.com/openshift/builder/commit/ff595e4bbf5301039fc62f0cdd7b5610605f633e) `sha256:7b5a0548f4c721536a61e9fb9748ce52c85a9bac0a169b88abb33cb48dd2293d`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [9d55fd1a](https://github.com/openshift/driver-toolkit/commit/9d55fd1aaba05830f857132bd149ee3cf18cc20f) `sha256:ed5d974f640be6d5694b69e78aa4262384ad0f700785f472ca39547f5ffb4f57`
* [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver) git [500ab5d3](https://github.com/openshift/gcp-pd-csi-driver/commit/500ab5d31ad382805070c8ae329a9a34163ebc99) `sha256:2530da3f1e4143353c8973d9dd7fd9883fe2564921286e7ba05e5b1444861eca`
* [ironic](https://github.com/openshift/ironic-image) git [9c57a819](https://github.com/openshift/ironic-image/commit/9c57a81902530b0268eddd7ad623a972b5ba4042) `sha256:2b4b7d701c34eba75c2dd9f9d8fe5186156b73c73e2c1aa1d23c93dcc6dce144`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [6c92e542](https://github.com/openshift/ironic-rhcos-downloader/commit/6c92e5425b58baa9d4dd951a992b7460e8407247) `sha256:2219d0cafcfee4503f93c495359d4d96ebd8f673f810b00490321d906ad94340`
* [keepalived-ipfailover](https://github.com/openshift/images) git [bb4535b7](https://github.com/openshift/images/commit/bb4535b7069cab2de0174be29bccccde6d623b4f) `sha256:902d6ae3911f3bd08f658241ce9ee7099f4834c910d6f36ffaaebfdc4870539e`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [64bfec79](https://github.com/openshift/machine-os-images/commit/64bfec79ae03b50b1da5b614a4cca2937ea9927d) `sha256:2db6b706b6447aaf6e291c7ee6b1bb541da66fee640838bba64b99935ac0bfd0`
* [metallb-frr](https://github.com/openshift/frr) git [fc0fe74f](https://github.com/openshift/frr/commit/fc0fe74f94b415b28d772dbc61f6323171a11b50) `sha256:37322ccd3bea46c564beab6179b7586d3b5bb1d88a6713f4a64ed272b7cb3b46`
* [monitoring-plugin](https://github.com/openshift/monitoring-plugin) git [c6a042a6](https://github.com/openshift/monitoring-plugin/commit/c6a042a64369147cf997e5e794b89e577a3c3532) `sha256:c40e31f051e504652e59ded1016bac7a3274fbe74c7850a3be7a8050dde672ed`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:634e4a6e6aadd2e105bb48ace9c3cdcc7c7982b7b24164531b4da094a6fdd2d9`
* [openstack-cinder-csi-driver](https://github.com/openshift/cloud-provider-openstack) git [c4fe3e8a](https://github.com/openshift/cloud-provider-openstack/commit/c4fe3e8ad29e58f081f3883de0893c2025a097b2) `sha256:164c64257c391f387d59cf3965aeaca40675813366f0fb5f111c2dccc86270a2`
* [rhel-coreos](https://github.com/openshift/os) git [63e9aa40](https://github.com/openshift/os/commit/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f) `sha256:509999589a72490a9f56327582cdc2a58dff4adf03ecbf51afdf09869a4e7e2c`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [63e9aa40](https://github.com/openshift/os/commit/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f) `sha256:9e6ba8226550edfe5d73569aabcd014a165ec8432ae8359e709b6a33c9d86381`
* [tools](https://github.com/openshift/oc) git [7f1d6f88](https://github.com/openshift/oc/commit/7f1d6f88cb0c8ed5c877fc0ae2bd99298c6339f2) `sha256:2a3ab73a1bec0a59f0d98813f7bc627fa62e036e80a12b2d5cd972887d8d513c`


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/200070b922dcf6bfd4819d7063f13e14ea296241)

* [OCPBUGS-63633](https://issues.redhat.com/browse/OCPBUGS-63633): Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 [#10037](https://github.com/openshift/installer/pull/10037)
* [Full changelog](https://github.com/openshift/installer/compare/cbd9f67f1260b158294f7dd16a87863c139702cb...200070b922dcf6bfd4819d7063f13e14ea296241)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/17948f42adc4fce592908d48730f45d665bcbbba)

* [OCPBUGS-63546](https://issues.redhat.com/browse/OCPBUGS-63546): ccoctl: add public-key-file flag to create-all [#936](https://github.com/openshift/cloud-credential-operator/pull/936)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/d391c0b339c48f49711ccff9ebac62039bf5c6f7...17948f42adc4fce592908d48730f45d665bcbbba)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)

* [OCPBUGS-63542](https://issues.redhat.com/browse/OCPBUGS-63542): Change the capacity struct from int to ptrOfInt [#185](https://github.com/openshift/cloud-network-config-controller/pull/185)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/467e50feff5a56afbf9ccefc025781c9ccff8eca...a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/276696ccf679830b25df341edb7aae9bb3f4e763)

* [OCPBUGS-63164](https://issues.redhat.com/browse/OCPBUGS-63164): ccm: disable unused secure-serving port and webhook [#419](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/419)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/e355ad389d1d09be1a83f024f54b15e844982d0a...276696ccf679830b25df341edb7aae9bb3f4e763)


### [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator/tree/234e218207ec963df04ec1fedad85a421eb7a1ff)

* [OCPBUGS-63173](https://issues.redhat.com/browse/OCPBUGS-63173): Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.20 [#62](https://github.com/openshift/cluster-api-operator/pull/62)
* [Full changelog](https://github.com/openshift/cluster-api-operator/compare/3ec30377ffff951dc9c0fc2257d290e4b4958465...234e218207ec963df04ec1fedad85a421eb7a1ff)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/438c9dba80ddadeabe9efe4a654297a7b550b2b8)

* [OCPBUGS-64684](https://issues.redhat.com/browse/OCPBUGS-64684): Add priority field to prevent early shutdown [#890](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/890)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/5a7da72ce2d21fc0900b428334865d97f39f6037...438c9dba80ddadeabe9efe4a654297a7b550b2b8)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/b3c82b2eec66ae3ae510df0603af1212c34be618)

* [OCPBUGS-63587](https://issues.redhat.com/browse/OCPBUGS-63587): port 9193 need to be internal and port 9194 need to have a service [#280](https://github.com/openshift/cluster-machine-approver/pull/280)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/ce2750589129dd20b3d1b6a5e7bb8c392d658c5c...b3c82b2eec66ae3ae510df0603af1212c34be618)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/870b44fc269ae4e790a3487d1795880d93ff72a9)

* [OCPBUGS-62978](https://issues.redhat.com/browse/OCPBUGS-62978): add tls configuration for the monitoring plugin deployment [#2718](https://github.com/openshift/cluster-monitoring-operator/pull/2718)
* [OCPBUGS-62829](https://issues.redhat.com/browse/OCPBUGS-62829): Remove cluster from non-multicluster dashboards [#2701](https://github.com/openshift/cluster-monitoring-operator/pull/2701)
* [OCPBUGS-64577](https://issues.redhat.com/browse/OCPBUGS-64577): Fix KSM deny-list typo [#2729](https://github.com/openshift/cluster-monitoring-operator/pull/2729)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/c2dfaad07a7098d4b88df54d88fa2b77f18df52b...870b44fc269ae4e790a3487d1795880d93ff72a9)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/b343f70f19ffd559e1a81d3a3e65bd106e634c13)

* [OCPBUGS-63507](https://issues.redhat.com/browse/OCPBUGS-63507): references to github.com/sclorg/django-ex.git now also refer to the branch [#655](https://github.com/openshift/cluster-samples-operator/pull/655)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/62b3623c6a2860e7a8cc368dbe76e767508cd261...b343f70f19ffd559e1a81d3a3e65bd106e634c13)


### [console](https://github.com/openshift/console/tree/e58e5b0246b82eb1c4a4a05957c9f6ef9c62ee40)

* [OCPBUGS-63608](https://issues.redhat.com/browse/OCPBUGS-63608): Fix catalog search relevance scoring, so that operators with attribute.keywords are displayed and remove unnecessary metadataName from calculation [#15648](https://github.com/openshift/console/pull/15648)
* [Full changelog](https://github.com/openshift/console/compare/c169e287163011576d8eae2576a8e4b9069b2a27...e58e5b0246b82eb1c4a4a05957c9f6ef9c62ee40)


### [console-operator](https://github.com/openshift/console-operator/tree/cdbc995ad9906b20a6048630d5d8af285bad7cc5)

* [OCPBUGS-64602](https://issues.redhat.com/browse/OCPBUGS-64602): Remove v1alpha1 ConsolePlugin version from CRDs status [#1060](https://github.com/openshift/console-operator/pull/1060)
* [Full changelog](https://github.com/openshift/console-operator/compare/5e127e5f49c56b47914e2ba4aedb09e99b165800...cdbc995ad9906b20a6048630d5d8af285bad7cc5)


### [csi-driver-manila, csi-driver-manila-operator, csi-driver-nfs, hyperkube, ibm-cloud-controller-manager, ibm-vpc-block-csi-driver, ibm-vpc-block-csi-driver-operator, ibmcloud-cluster-api-controllers, ibmcloud-machine-controllers, kube-proxy, nutanix-cloud-controller-manager, nutanix-machine-controllers, pod, powervs-block-csi-driver, powervs-block-csi-driver-operator, powervs-cloud-controller-manager, powervs-machine-controllers, vsphere-cloud-controller-manager, vsphere-cluster-api-controllers, vsphere-csi-driver, vsphere-csi-driver-operator, vsphere-csi-driver-syncer, vsphere-problem-detector](https://github.com/openshift/kubernetes/tree/cf396bff09dcb68a96f718b5e0e80b50e874afb5)

* NO-JIRA: enable CBOR tests [#2502](https://github.com/openshift/kubernetes/pull/2502)
* [Full changelog](https://github.com/openshift/kubernetes/compare/debdebd535dc3f5d0ab3557aa79172ff92344d97...cf396bff09dcb68a96f718b5e0e80b50e874afb5)


### [etcd](https://github.com/openshift/etcd/tree/eac09c01677bb03daed156d407be27785fd61e0d)

* [OCPBUGS-63474](https://issues.redhat.com/browse/OCPBUGS-63474): 4.20 rebase 3.5.24 [#347](https://github.com/openshift/etcd/pull/347)
* [Full changelog](https://github.com/openshift/etcd/compare/9c065d4d842c8de57806426c13201413b4d595e2...eac09c01677bb03daed156d407be27785fd61e0d)


### [hypershift](https://github.com/openshift/hypershift/tree/a28b548128e1963b2e4166268471957a3457f70b)

* [OCPBUGS-63128](https://issues.redhat.com/browse/OCPBUGS-63128): resolve initContainer permission issue after node reboot [#7080](https://github.com/openshift/hypershift/pull/7080)
* [Full changelog](https://github.com/openshift/hypershift/compare/14be17ccb7fbc772a701aeecf32ee623b41858d0...a28b548128e1963b2e4166268471957a3457f70b)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/a94ae791d499025954a6f99d724e4195b450de07)

* [OCPBUGS-63534](https://issues.redhat.com/browse/OCPBUGS-63534): Create temporal allow policy [#5373](https://github.com/openshift/machine-config-operator/pull/5373)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/d239f7a5eacf418d8333d021dc02abe3ec176ace...a94ae791d499025954a6f99d724e4195b450de07)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/9de315953ad1b357c35003937a1a2f27aa9068e0)

* Hide VirtualMachine networks page in 4.20 release [#290](https://github.com/openshift/networking-console-plugin/pull/290)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f09c58b909fd6479e0099f7962ef73b70e280685...9de315953ad1b357c35003937a1a2f27aa9068e0)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/b598121bb70555120dde8d60fa9fbcde4f7b3d65)

* [OCPBUGS-63030](https://issues.redhat.com/browse/OCPBUGS-63030): removes unintended exec permissions [#1291](https://github.com/openshift/oc-mirror/pull/1291)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/b51b46d4d6000054d1a11568b3302f709a28bdde...b598121bb70555120dde8d60fa9fbcde4f7b3d65)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/8a02fda7f45172bf487a0c613cf47caaf1116d36)

* [OCPBUGS-63007](https://issues.redhat.com/browse/OCPBUGS-63007): kubevirt: fix bad release of IPs of live migratable pods [#2801](https://github.com/openshift/ovn-kubernetes/pull/2801)
* [OCPBUGS-63577](https://issues.redhat.com/browse/OCPBUGS-63577): [release-4.20] CORENET-6055: Dockerfile: Unpin OVN and consume the latest from FDP. [#2808](https://github.com/openshift/ovn-kubernetes/pull/2808)
* [OCPBUGS-63631](https://issues.redhat.com/browse/OCPBUGS-63631): Skip Pending pods in EgressIP status updates [#2831](https://github.com/openshift/ovn-kubernetes/pull/2831)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/050ed2c215b55aef456c73c5217427600756ae75...8a02fda7f45172bf487a0c613cf47caaf1116d36)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/fa749d65d8eca1cc937554baab91385a78ec8ce1)

* [OCPBUGS-63624](https://issues.redhat.com/browse/OCPBUGS-63624): bump github.com/prometheus/procfs to v0.16.1 [#173](https://github.com/openshift/node_exporter/pull/173)
* [Full changelog](https://github.com/openshift/node_exporter/compare/56f6158e797ab80e5e0da2cb0ba701cb02902ef7...fa749d65d8eca1cc937554baab91385a78ec8ce1)


### [tests](https://github.com/openshift/origin/tree/be01d22067bd78a7c62e5fac4d98567c939a49b1)

* [OCPBUGS-64593](https://issues.redhat.com/browse/OCPBUGS-64593): [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support [#30415](https://github.com/openshift/origin/pull/30415)
* [OCPBUGS-63725](https://issues.redhat.com/browse/OCPBUGS-63725): CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift [#30439](https://github.com/openshift/origin/pull/30439)
* [Full changelog](https://github.com/openshift/origin/compare/0913987edd6a422327a2f68e254a9d0eec8ee8ed...be01d22067bd78a7c62e5fac4d98567c939a49b1)