# 4.20.3

Created: 2025-11-06 16:07:24 +0000 UTC

Image Digest: `sha256:fb3aaccdcb11bda4391827bd8578385bf331d5fa53d611edffcb52cdb8f2ed06`


## Changes from 4.20.2

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.5
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20251027-0 to 9.6.20251105-0


### Rebuilt images without code change

* [agent-installer-api-server](https://github.com/openshift/assisted-service) git [4b116f46](https://github.com/openshift/assisted-service/commit/4b116f46ca39a4933cab5647e5db44432c752b80) `sha256:d8aa03c18a66530f3351ad016bc4f4dc644f3272ccc5a447b9ec4464b5d17b56`
* [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent) git [62dc63f1](https://github.com/openshift/assisted-installer-agent/commit/62dc63f18f2c4a6a0cf1043710d055fe57f8fa28) `sha256:4d3dd6c542fc8f81703f69472722c6b7b300efce59c56a5a32b72a49a2f9d516`
* [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator) git [0d7067cb](https://github.com/openshift/cluster-etcd-operator/commit/0d7067cb286ad4efad5cad9bcff17656ef9827a3) `sha256:eab3ca362aaa7355dec55aef1d0c3fa0959c1dfb95724f65d432fd3523a91bf3`
* [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator) git [56b12e27](https://github.com/openshift/cluster-node-tuning-operator/commit/56b12e277eec356e330a9f7dac4373a1faf52af2) `sha256:165a34e7c8599a67f7de371835006064164422d3918538a2df0cfe5f3af40008`
* [docker-builder](https://github.com/openshift/builder) git [ff595e4b](https://github.com/openshift/builder/commit/ff595e4bbf5301039fc62f0cdd7b5610605f633e) `sha256:e8717882f658d42cd6f3f3db0727fc0529cc8497ff03f5224bb8e36781568a0a`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [9d55fd1a](https://github.com/openshift/driver-toolkit/commit/9d55fd1aaba05830f857132bd149ee3cf18cc20f) `sha256:33734a45fadad7fcd7f9412abea3a491e9031d488ef4665614c0754882fd73e2`
* [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver) git [500ab5d3](https://github.com/openshift/gcp-pd-csi-driver/commit/500ab5d31ad382805070c8ae329a9a34163ebc99) `sha256:c5c7b4a1bd7f7147686e48c3a8c3428711d156efa1259d901d01a412d7ecebf2`
* [keepalived-ipfailover](https://github.com/openshift/images) git [bb4535b7](https://github.com/openshift/images/commit/bb4535b7069cab2de0174be29bccccde6d623b4f) `sha256:fb6ba9ee0552e28b1a58ac9f665faff2a3d1043515354371752fc37de8744908`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [64bfec79](https://github.com/openshift/machine-os-images/commit/64bfec79ae03b50b1da5b614a4cca2937ea9927d) `sha256:d75e16aeadb215b65a4b77bc8a45cc161f03fb6cc1c366c25dafc63308e5d0e0`
* [metallb-frr](https://github.com/openshift/frr) git [fc0fe74f](https://github.com/openshift/frr/commit/fc0fe74f94b415b28d772dbc61f6323171a11b50) `sha256:1a6f8d27572cc549ae1c30cb1ef95cf3acca39a9eaf5bff9559999e8b83859ca`
* [monitoring-plugin](https://github.com/openshift/monitoring-plugin) git [c6a042a6](https://github.com/openshift/monitoring-plugin/commit/c6a042a64369147cf997e5e794b89e577a3c3532) `sha256:558ef848bd6d2d5ddd24558116dc95c976675a55d0f037a68beec4e1a208fe96`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:b955f88b45703072354c90428783c90057e724abeeb2e19b4477c8a79b8f994f`
* [openstack-cinder-csi-driver](https://github.com/openshift/cloud-provider-openstack) git [c4fe3e8a](https://github.com/openshift/cloud-provider-openstack/commit/c4fe3e8ad29e58f081f3883de0893c2025a097b2) `sha256:e0f0e8a226f05bdbcd94ffe1e57bf65b76ef702fad8849cb8fee8afdca870d99`
* [rhel-coreos](https://github.com/openshift/os) git [63e9aa40](https://github.com/openshift/os/commit/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f) `sha256:2c149da970241fa256779c5dfaeeb39a7f06cf98424bf058d6932ebd7e4adf3a`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [63e9aa40](https://github.com/openshift/os/commit/63e9aa4008eb65a02a2d70c9c086cbd8e18e149f) `sha256:faa3d68b4885f87bddfdd0e9107920f3dfa268a0efe7a0b65f7f0765956ba9ff`
* [tools](https://github.com/openshift/oc) git [7f1d6f88](https://github.com/openshift/oc/commit/7f1d6f88cb0c8ed5c877fc0ae2bd99298c6339f2) `sha256:947592f2b5cae5af02c9e45030c9a4ca6037c3f1cc8fd848e0c954c35f36b5ad`


### [aws-cloud-controller-manager, aws-cluster-api-controllers, aws-ebs-csi-driver, aws-ebs-csi-driver-operator, aws-machine-controllers, aws-pod-identity-webhook, azure-cloud-controller-manager, azure-cloud-node-manager, azure-cluster-api-controllers, azure-disk-csi-driver, azure-disk-csi-driver-operator, azure-file-csi-driver, azure-file-csi-driver-operator, azure-machine-controllers, azure-workload-identity-webhook, hyperkube, ibm-cloud-controller-manager, ibm-vpc-block-csi-driver, ibm-vpc-block-csi-driver-operator, ibmcloud-machine-controllers, ironic, ironic-agent, ironic-machine-os-downloader, ironic-static-ip-manager, kube-proxy, machine-image-customization-controller, nutanix-cloud-controller-manager, nutanix-machine-controllers, pod, vsphere-cloud-controller-manager, vsphere-cluster-api-controllers, vsphere-csi-driver, vsphere-csi-driver-operator, vsphere-csi-driver-syncer, vsphere-problem-detector](https://github.com/openshift/kubernetes/tree/cf396bff09dcb68a96f718b5e0e80b50e874afb5)

* NO-JIRA: enable CBOR tests [#2502](https://github.com/openshift/kubernetes/pull/2502)
* [Full changelog](https://github.com/openshift/kubernetes/compare/debdebd535dc3f5d0ab3557aa79172ff92344d97...cf396bff09dcb68a96f718b5e0e80b50e874afb5)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/200070b922dcf6bfd4819d7063f13e14ea296241)

* [OCPBUGS-63633](https://issues.redhat.com/browse/OCPBUGS-63633): Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 [#10037](https://github.com/openshift/installer/pull/10037)
* [Full changelog](https://github.com/openshift/installer/compare/cbd9f67f1260b158294f7dd16a87863c139702cb...200070b922dcf6bfd4819d7063f13e14ea296241)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/17948f42adc4fce592908d48730f45d665bcbbba)

* [OCPBUGS-63546](https://issues.redhat.com/browse/OCPBUGS-63546): ccoctl: add public-key-file flag to create-all [#936](https://github.com/openshift/cloud-credential-operator/pull/936)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/d391c0b339c48f49711ccff9ebac62039bf5c6f7...17948f42adc4fce592908d48730f45d665bcbbba)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)

* [OCPBUGS-63542](https://issues.redhat.com/browse/OCPBUGS-63542): Change the capacity struct from int to ptrOfInt [#185](https://github.com/openshift/cloud-network-config-controller/pull/185)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/467e50feff5a56afbf9ccefc025781c9ccff8eca...a365cf9c9f9f4d0d7841dead5145f7cc59dfac18)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/276696ccf679830b25df341edb7aae9bb3f4e763)

* [OCPBUGS-63164](https://issues.redhat.com/browse/OCPBUGS-63164): ccm: disable unused secure-serving port and webhook [#419](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/419)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/e355ad389d1d09be1a83f024f54b15e844982d0a...276696ccf679830b25df341edb7aae9bb3f4e763)


### [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator/tree/234e218207ec963df04ec1fedad85a421eb7a1ff)

* [OCPBUGS-63173](https://issues.redhat.com/browse/OCPBUGS-63173): Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.20 [#62](https://github.com/openshift/cluster-api-operator/pull/62)
* [Full changelog](https://github.com/openshift/cluster-api-operator/compare/3ec30377ffff951dc9c0fc2257d290e4b4958465...234e218207ec963df04ec1fedad85a421eb7a1ff)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/438c9dba80ddadeabe9efe4a654297a7b550b2b8)

* [OCPBUGS-64684](https://issues.redhat.com/browse/OCPBUGS-64684): Add priority field to prevent early shutdown [#890](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/890)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/5a7da72ce2d21fc0900b428334865d97f39f6037...438c9dba80ddadeabe9efe4a654297a7b550b2b8)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/b3c82b2eec66ae3ae510df0603af1212c34be618)

* [OCPBUGS-63587](https://issues.redhat.com/browse/OCPBUGS-63587): port 9193 need to be internal and port 9194 need to have a service [#280](https://github.com/openshift/cluster-machine-approver/pull/280)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/ce2750589129dd20b3d1b6a5e7bb8c392d658c5c...b3c82b2eec66ae3ae510df0603af1212c34be618)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/870b44fc269ae4e790a3487d1795880d93ff72a9)

* [OCPBUGS-62978](https://issues.redhat.com/browse/OCPBUGS-62978): add tls configuration for the monitoring plugin deployment [#2718](https://github.com/openshift/cluster-monitoring-operator/pull/2718)
* [OCPBUGS-62829](https://issues.redhat.com/browse/OCPBUGS-62829): Remove cluster from non-multicluster dashboards [#2701](https://github.com/openshift/cluster-monitoring-operator/pull/2701)
* [OCPBUGS-64577](https://issues.redhat.com/browse/OCPBUGS-64577): Fix KSM deny-list typo [#2729](https://github.com/openshift/cluster-monitoring-operator/pull/2729)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/c2dfaad07a7098d4b88df54d88fa2b77f18df52b...870b44fc269ae4e790a3487d1795880d93ff72a9)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/b343f70f19ffd559e1a81d3a3e65bd106e634c13)

* [OCPBUGS-63507](https://issues.redhat.com/browse/OCPBUGS-63507): references to github.com/sclorg/django-ex.git now also refer to the branch [#655](https://github.com/openshift/cluster-samples-operator/pull/655)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/62b3623c6a2860e7a8cc368dbe76e767508cd261...b343f70f19ffd559e1a81d3a3e65bd106e634c13)


### [console](https://github.com/openshift/console/tree/e58e5b0246b82eb1c4a4a05957c9f6ef9c62ee40)

* [OCPBUGS-63608](https://issues.redhat.com/browse/OCPBUGS-63608): Fix catalog search relevance scoring, so that operators with attribute.keywords are displayed and remove unnecessary metadataName from calculation [#15648](https://github.com/openshift/console/pull/15648)
* [Full changelog](https://github.com/openshift/console/compare/c169e287163011576d8eae2576a8e4b9069b2a27...e58e5b0246b82eb1c4a4a05957c9f6ef9c62ee40)


### [console-operator](https://github.com/openshift/console-operator/tree/cdbc995ad9906b20a6048630d5d8af285bad7cc5)

* [OCPBUGS-64602](https://issues.redhat.com/browse/OCPBUGS-64602): Remove v1alpha1 ConsolePlugin version from CRDs status [#1060](https://github.com/openshift/console-operator/pull/1060)
* [Full changelog](https://github.com/openshift/console-operator/compare/5e127e5f49c56b47914e2ba4aedb09e99b165800...cdbc995ad9906b20a6048630d5d8af285bad7cc5)


### [etcd](https://github.com/openshift/etcd/tree/eac09c01677bb03daed156d407be27785fd61e0d)

* [OCPBUGS-63474](https://issues.redhat.com/browse/OCPBUGS-63474): 4.20 rebase 3.5.24 [#347](https://github.com/openshift/etcd/pull/347)
* [Full changelog](https://github.com/openshift/etcd/compare/9c065d4d842c8de57806426c13201413b4d595e2...eac09c01677bb03daed156d407be27785fd61e0d)


### [hypershift](https://github.com/openshift/hypershift/tree/a28b548128e1963b2e4166268471957a3457f70b)

* [OCPBUGS-63128](https://issues.redhat.com/browse/OCPBUGS-63128): resolve initContainer permission issue after node reboot [#7080](https://github.com/openshift/hypershift/pull/7080)
* [Full changelog](https://github.com/openshift/hypershift/compare/14be17ccb7fbc772a701aeecf32ee623b41858d0...a28b548128e1963b2e4166268471957a3457f70b)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/a94ae791d499025954a6f99d724e4195b450de07)

* [OCPBUGS-63534](https://issues.redhat.com/browse/OCPBUGS-63534): Create temporal allow policy [#5373](https://github.com/openshift/machine-config-operator/pull/5373)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/d239f7a5eacf418d8333d021dc02abe3ec176ace...a94ae791d499025954a6f99d724e4195b450de07)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/9de315953ad1b357c35003937a1a2f27aa9068e0)

* Hide VirtualMachine networks page in 4.20 release [#290](https://github.com/openshift/networking-console-plugin/pull/290)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f09c58b909fd6479e0099f7962ef73b70e280685...9de315953ad1b357c35003937a1a2f27aa9068e0)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/b598121bb70555120dde8d60fa9fbcde4f7b3d65)

* [OCPBUGS-63030](https://issues.redhat.com/browse/OCPBUGS-63030): removes unintended exec permissions [#1291](https://github.com/openshift/oc-mirror/pull/1291)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/b51b46d4d6000054d1a11568b3302f709a28bdde...b598121bb70555120dde8d60fa9fbcde4f7b3d65)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/8a02fda7f45172bf487a0c613cf47caaf1116d36)

* [OCPBUGS-63007](https://issues.redhat.com/browse/OCPBUGS-63007): kubevirt: fix bad release of IPs of live migratable pods [#2801](https://github.com/openshift/ovn-kubernetes/pull/2801)
* [OCPBUGS-63577](https://issues.redhat.com/browse/OCPBUGS-63577): [release-4.20] CORENET-6055: Dockerfile: Unpin OVN and consume the latest from FDP. [#2808](https://github.com/openshift/ovn-kubernetes/pull/2808)
* [OCPBUGS-63631](https://issues.redhat.com/browse/OCPBUGS-63631): Skip Pending pods in EgressIP status updates [#2831](https://github.com/openshift/ovn-kubernetes/pull/2831)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/050ed2c215b55aef456c73c5217427600756ae75...8a02fda7f45172bf487a0c613cf47caaf1116d36)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/fa749d65d8eca1cc937554baab91385a78ec8ce1)

* [OCPBUGS-63624](https://issues.redhat.com/browse/OCPBUGS-63624): bump github.com/prometheus/procfs to v0.16.1 [#173](https://github.com/openshift/node_exporter/pull/173)
* [Full changelog](https://github.com/openshift/node_exporter/compare/56f6158e797ab80e5e0da2cb0ba701cb02902ef7...fa749d65d8eca1cc937554baab91385a78ec8ce1)


### [tests](https://github.com/openshift/origin/tree/be01d22067bd78a7c62e5fac4d98567c939a49b1)

* [OCPBUGS-64593](https://issues.redhat.com/browse/OCPBUGS-64593): [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support [#30415](https://github.com/openshift/origin/pull/30415)
* [OCPBUGS-63725](https://issues.redhat.com/browse/OCPBUGS-63725): CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift [#30439](https://github.com/openshift/origin/pull/30439)
* [Full changelog](https://github.com/openshift/origin/compare/0913987edd6a422327a2f68e254a9d0eec8ee8ed...be01d22067bd78a7c62e5fac4d98567c939a49b1)