Back to index

PullSpec:

quay.io/openshift-release-dev/ocp-release:4.20.19-multi

Team Approvals:

Tests:

• Informing jobs
  • e2e-aws-ovn-multi-a-a Succeeded periodic-ci-openshift-multiarch-main-nightly-4.20-ocp-e2e-aws-ovn-multi-a-a
  • e2e-aws-ovn-multi-x-x Succeeded periodic-ci-openshift-multiarch-main-nightly-4.20-ocp-e2e-aws-ovn-multi-x-x
  • hypershift-e2e-aks-multi-x-ax Failed (1 retry) periodic-ci-openshift-hypershift-release-4.20-periodics-e2e-aks-multi-x-ax

    • Attempt 1 Failed
    • Attempt 2 Failed

Upgrades from:

• 4.21.10 - Failed Failed

---

Loading changelog, this may take a while ...

Changes from 4.21.10

Created: 2026-04-16 13:58:19 +0000 UTC

Image Digest: sha256:653d686bf84c637a83132c305bbe539daf2ef5135a12d0db2cbc0ae651757698

Release 4.20.19 was created from quay.io/openshift-release-dev/ocp-release-nightly@sha256:ba94cbdcda13f0db69d049d6300cdd584c555dd69d67a1f2ef2361691dcd4c23

Components

• Kubectl upgraded from 1.34.1 to 1.33.3
• Kubernetes upgraded from 1.34.6 to 1.33.9
• Kubernetes Tests upgraded from 1.34.1 to 1.33.4
• Red Hat Enterprise Linux CoreOS upgraded from 10.2.20260405-0 to 9.6.20260414-0

  The CoreOS links above are for the base CoreOS layer used to build the OpenShift node image and do not contain OpenShift components. This is normally only useful to devs working closely with the CoreOS team. For info about the node image, see the Node Image Info section.

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
AWSDualStackInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
AzureDualStackInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
CBORServingAndStorage (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
CRDCompatibilityRequirementOperator (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClientsAllowCBOR (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClientsPreferCBOR (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagement (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ClusterAPIMachineManagementVSphere (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
EventTTL (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPDualStackInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
HyperShiftOnlyDynamicResourceAllocation (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
KMSEncryption (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ManagedBootImagesCPMS (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
MutableCSINodeAllocatableCount (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NewOLMBoxCutterRuntime (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
NoRegistryClusterInstall (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
OSStreams (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
OnPremDNSRecords (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ProvisioningRequestAvailable (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
GCPClusterHostedDNSInstall (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Enabled	Enabled
ImageStreamImportMode (4 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Enabled	Enabled
ManagedBootImagesAzure (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Enabled	Enabled
ManagedBootImagesvSphere (6 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Enabled	Enabled
SigstoreImageVerificationPKI (0 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Enabled	Enabled
VolumeAttributesClass (50 tests)	Disabled (Changed)	Disabled (Changed)	Enabled	Enabled	Enabled	Enabled
NewOLMWebhookProviderOpenshiftServiceCA (0 tests)	Disabled	Disabled (Changed)	Disabled	Enabled	Disabled	Enabled
IngressControllerLBSubnetsAWS (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
SetEIPForNLBIngressController (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
BootImageSkewEnforcement (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
KMSEncryptionProvider (0 tests)	Disabled	Disabled	Enabled	Enabled	Enabled (Changed)	Enabled (Changed)
VSphereMixedNodeEnv (0 tests)	Disabled	Disabled	Enabled	Enabled	Disabled (Changed)	Disabled (Changed)
DynamicResourceAllocation (47 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
InsightsConfigAPI (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
NoRegistryClusterOperations (0 tests)				Enabled (New)		Enabled (New)
NodeSwap (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

New images

• cluster-kube-cluster-api-operator git 234e2182 sha256:a859133a53ffe7a6559e313b6334bd4b0039c06a9f6248b03060d506f3585b8c
• ovirt-csi-driver git 1db726a9 sha256:49ed7bcaf77ff83331671641f7f66ca967c14f5d2cd858e00ffb53ce06d61cd4
• ovirt-csi-driver-operator git 7e1f4a30 sha256:5ca96a11167dbc13b9c2b5108220e25405d3f858e5ad9c0d22fca4c7ec62cef7

Removed images

• rhel-coreos-10
• rhel-coreos-10-extensions

Rebuilt images without code change

• egress-router-cni git 5e0f8d1b sha256:f7e28d9938f33314269d8079649373b4befb36895b8636c4c2ec3c0fee47c91c

agent-installer-api-server

• OCPBUGS-81880: Prefer multipath disk in ABI disk selection #10111
• OCPBUGS-70300: Prevent race in agent-installer kubeconfig generation #8707
• OCPBUGS-65901: Retry incomplete cluster registration in ABI #8429
• OCPBUGS-57606: Updating ose-agent-installer-api-server-container image to be consist… #8399
• OCPBUGS-63486: Align kube descheduler activation CR with OVE needs #8136
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

• OCPBUGS-81641: fix: allow workers to join TNA cluster when 1 master + arbiter are ready #2070
• Full changelog

agent-installer-node-agent

• OCPBUGS-57718: Update golang images to 1.24 for OpenShift 4.20 #1194
• Full changelog

agent-installer-ui

• Updating assisted-installer-ui-container image to be consistent with ART for 4.20 (#3458) #3458
• Add support for release branches in PR workflow (#3529) #3529
• remove external platforms field from below sea level UI (#3318) #3318
• Adding TechPreview Budge for Assisted installer and agent (#3296) #3296
• OCPBUGS-62680: Include assisted disconnected UI image in release payload (#3188) (#3189) #3188
• OCPBUGS-61953: Update dependency sourcing to remote (#3178) #3178
• Full changelog

agent-installer-utils

• OCPBUGS-77238: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 2f3015a #224
• OCPBUGS-75868: Increase Konflux build pipeline memory #247
• OCPBUGS-68324: bump github.com/sirupsen/logrus to v1.9.3 #235
• OCPBUGS-69834: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 20eb21c #208
• OCPBUGS-69830: Update Konflux references #207
• OCPBUGS-67306: Update Konflux release version to 4.20.8 #212
• OCPBUGS-66431: Add Konflux PipelineRun params required by release pipeline #206
• OCPBUGS-66425: Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 13cf619 #186
• OCPBUGS-66422: Update Konflux references #185
• OCPBUGS-66406: Update Konflux release version to 4.20.6 #204
• OCPBUGS-65715: Update 4.20 version to 4.20.4 #196
• OCPBUGS-64694: Update 4.20 version to 4.20.2 #193
• OCPBUGS-63585: AGENT-1203: Simplify isobuilder #189
• OCPBUGS-63590: Update 4.20 version to 4.20.1 #190
• OCPBUGS-63372: Backport Konflux changes #183
• OCPBUGS-62749: Red Hat Konflux kflux-prd-rh02 update ove-ui-iso-4-20 #172
• Full changelog

aws-cluster-api-controllers

• OCPBUGS-61040: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.9.2 (d3a7da1) into release-4.20 #578
• Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

• OCPBUGS-72563: deploy prometheus role and binding on hypershift guest #491
• OCPBUGS-65895: allow all-egress for efs operator #473
• OCPBUGS-65686: Bump gophercloud #470
• OCPBUGS-63560: Add RBAC ClusterRole and Binding for driver node #456
• OCPBUGS-62688: Add withCABundleDaemonSetHook() to AWS EFS operator #441
• Full changelog

aws-kms-encryption-provider

• OCPBUGS-78426: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.20 #34
• Full changelog

aws-machine-controllers

• OCPBUGS-72570: Fix reconciler consistency checks in Update and Exists #164
• OCPBUGS-63136: client: re-use a single file for building the session instead of randomly named files #148
• Full changelog

aws-pod-identity-webhook

• OCPBUGS-74169: Fix GOTOOLCHAIN env var #212
• Full changelog

azure-kms-encryption-provider

• OCPBUGS-78423: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.20 #28
• Full changelog

azure-machine-controllers

• OCPBUGS-65708: Set updateDomainCount to one when faultDomainCount is one #173
• OCPBUGS-63535: Support DataDisks on Azure Stack Hub #165
• Full changelog

baremetal-installer, installer, installer-artifacts

• OCPBUGS-78694: [release-4.20]: openstack: Disable LoadBalancer in cloud config when Octavia is unavailable #10401
• OCPBUGS-79665: Use correct Project ID with GCP Shared VPC #10436
• OCPBUGS-80884: [release-4.20] Add c8g* to tested_instance_types_aarch64 #10437
• OCPBUGS-77896: Increase size of /var/ostreecontainer mount #10365
• OCPBUGS-78091: fix wavelength zone name regex #10373
• OCPBUGS-77050: Update the RHCOS 4.20 bootimage metadata to 9.6.20260217-1 #10358
• OCPBUGS-74674: [release-4.20] GCP: skip AI zones #10273
• OCPBUGS-74551: add support for NVIDIA H100 and H200 enabled machine series #10263
• OCPBUGS-66356: Update the RHCOS 4.20 bootimage metadata to 9.6.20260112-0 #10247
• OCPBUGS-73681: pkg/asset/manifests/azure: save cidr blocks #10208
• OCPBUGS-73785: ensure deterministic zone ordering for control plane machines #10219
• OCPBUGS-71212: Increase agent-installer pre-network-manager timeout #10199
• OCPBUGS-65767: Add StandardFXmdsv2Family to azure tested instance type list #10104
• OCPBUGS-66231: Use separate tmpfs for ostree checkout on live ISO #10140
• OCPBUGS-65763: continue to update 02_storage.json using new property storageAccountId #10103
• OCPBUGS-66257: CORS-4249: bump ARO marketplace images #10142
• OCPBUGS-66207, OCPBUGS-66208: Fix console info for interactive agent installer #10136
• Revert “OCPBUGS-65586: Update the RHCOS 4.20 bootimage metadata to 9.6.202511…” #10093
• OCPBUGS-65586: Update the RHCOS 4.20 bootimage metadata to 9.6.202511… #10084
• OCPBUGS-64924: Azure UPI ARM template: use storageAccountId #10069
• OCPBUGS-64595: Remove pending items on gcp no-op #10056
• OCPBUGS-63633: Update the RHCOS 4.20 bootimage metadata to 9.6.20251023-0 #10037
• OCPBUGS-63461: Prevent duplicate noProxy when adding nodes #10028
• OCPBUGS-62920: AGENT-1269: Use agent-installer-ui image from release #10009
• OCPBUGS-62343: [release-4.20] vSphere 7 deprecation #9973
• OCPBUGS-62124: Update the RHCOS 4.20 bootimage metadata #9997
• OCPBUGS-62948: Add an option in image-based installation to specify architecture #9943
• OCPBUGS-62935: Add MTU validation for networkConfig #10010
• OCPBUGS-62846: None: Allow IPv6 Primary DualStack installs on platforms None and External #10005
• OCPBUGS-62656: Set agent-extract-tui start timeout #9990
• OCPBUGS-62640: Wildcards not reliable for copying container files #9986
• OCPBUGS-62297: Set default for PrivateDNSZone Project ID #9968
• OCPBUGS-61528: Allow user to BYO private zone without specifying name #9936
• OCPBUGS-61552: Shellcheck fix 4.20 #9938
• Full changelog

baremetal-operator

• OCPBUGS-78745: OCPBUGS-78836: PR2774 and PR2793 backports [release-4.20] #470
• Bug OCPBUGS-76546: BMO fails to start servicing despite updates to HFC spec #460
• OCPBUGS-74987: Abort inspection/cleaning before powering off during deletion #453
• OCPBUGS-74084: Require PreprovisioningImage for deprovisioning when cleaning is enabled #446
• OCPBUGS-63538: Create a PreprovisioningImage for servicing if needed #435
• OCPBUGS-69667: Change architecture default to match controller #440
• Full changelog

baremetal-runtimecfg

• OCPBUGS-77170: Install dbus-tools, needed in pkg/monitor/dnsmasqmonitor.go #384
• Full changelog

cli, cli-artifacts, deployer, tools

• OCPBUGS-77495: Makefile: Strip debugging symbols by default #2212
• OCPBUGS-77145: oc adm policy: Only initialize UserClient if built-in OAuth is enabled #2207
• OCPBUGS-74969: Fix unit test failure by updating ruby version to 3.3 #2194
• OCPBUGS-74965: Clear defaultNodeSelector to run on any node #2193
• OCPBUGS-66241: Fall back to simpler behavior, if setsid,ps,pkill are not installed #2158
• OCPBUGS-65481: pkg/cli/admin/upgrade: Tighten force warnings #2140
• OCPBUGS-65523: fix(must-gather): do not set node affinity if nodename is set #2142
• OCPBUGS-64791: Rely on overall available disk space of the mounted volume #2133
• OCPBUGS-64773: oc adm must-gather: Wrap gather in a session #2132
• OCPBUGS-61757: pkg/cli/admin/upgrade/recommend: Enable precheck and accept gates #2097
• Full changelog

cloud-credential-operator

• OCPBUGS-79368: google.golang.org/grpc v1.79.3 #994
• OCPBUGS-78200: Fix infrastructure resource name filtering in watch predicate #989
• OCPBUGS-74546: Resolve nil pointer exception in hasResourceTags #970
• OCPBUGS-65798: ccoctl azure: retry custom role creation on consistency errors #948
• OCPBUGS-63690: ccoctl: use pagination when listing resources in aws #941
• OCPBUGS-63546: ccoctl: add public-key-file flag to create-all #936
• OCPBUGS-61586: set cloud-credential-operator as default-container #916
• OCPBUGS-61225: ccoctl: aws to use proper issuer url on subsequent runs #912
• Full changelog

cloud-network-config-controller

• OCPBUGS-64742: Fix capacity calculation #188
• OCPBUGS-63542: Change the capacity struct from int to ptrOfInt #185
• Full changelog

cluster-authentication-operator

• OCPBUGS-66315: externaloidc: return errors when node statuses cannot be used to determine oidc state #814
• OCPBUGS-61896: set appropriate rolling update settings #792
• OCPBUGS-63319: (bugfix): configure status controller to remove unset versions #802
• OCPBUGS-64668: Update OIDC e2e test to expect admission-time validation error of invalid CEL expression #804
• Full changelog

cluster-autoscaler

• OCPBUGS-78690: allow clusterapi provider to skip paused resources #411
• OCPBUGS-77506: Pick upstream commits to Fix VPA recommender concurrent access panic #407
• OCPBUGS-63675: update node info processors to include unschedulable nodes #391
• OCPBUGS-63495: refactor cloud provider options #387
• Full changelog

cluster-baremetal-operator

• OCPBUGS-76340: Explicitly set the ReadOnlyRootFilesystem flag to false #555
• OCPBUGS-77488: Fix NO_PROXY matching for URLs with trailing dots #567
• OCPBUGS-77074: Update kubebuilder tools to more latest version #559
• OCPBUGS-75933: Explicitly set ReadOnlyRootFilesystem to false for machine-os-images so that SCC don’t end up enforcing it to true #552
• OCPBUGS-73916: Fix DNS resolution for metal3 service endpoints by adding trailing dots #548
• OCPBUGS-71203: Mount /etc/pki/ca-trust to machine-os-images & Enable runtime extraction of aarch64 images #543
• OCPBUGS-62316: Always have a service for ironic-api port #511
• Full changelog

cluster-capi-operator

• OCPBUGS-62755: kubeconfig controller: do not error on token secret not yet populated #377
• OCPBUGS-61770: Fix conversion of Machines without MachineSet #362
• Full changelog

cluster-cloud-controller-manager-operator

• OCPBUGS-63164: ccm: disable unused secure-serving port and webhook #419
• Full changelog

cluster-config-api

• CORENET-6431: network, virt: Graduate PreconfiguredUDNAddresses feature gate #2546
• OCPBUGS-66204: Introduce ClosedClientConnectionPolicy to IngressController API #2609
• OCPBUGS-66135: Add HTTPKeepAliveTimeout to IngressController API #2607
• OCPBUGS-64843: payload-command: remove authentication CR from hypershift payload #2573
• OCPBUGS-64940: Promote BYO OIDC features #2515
• OCPBUGS-62280: ConsoleLink CRD has incorrect additionalPrinterColumns entry #2509
• OCPBUGS-62256: ConsoleLink CRD has incorrect additionalPrinterColumns entry #2508
• OCPBUGS-61977: Add ‘AGE’ print column to MachineConfigNode object #2497
• OCPBUGS-56778: Disable PSA for 4.20 #2475
• Full changelog

cluster-csi-snapshot-controller-operator

• OCPBUGS-62258: add all-egress label to deployments on HCP and IBM #244
• Full changelog

cluster-etcd-operator

• OCPBUGS-78047: Prefer to remove members where they have another healthy machine in the same failure domain index #1564
• OCPBUGS-74624: Add priority field to prevent early shutdown #1508
• OCPBUGS-63677: Backport 1504 1514 release.420 #1516
• OCPBUGS-62738: CNTRLPLANE-1315:Add OpenShift Tests Extension (OTE) for cluster-etcd-operator #1491
• OCPBUGS-63249: Ensure revision.json persists on ungraceful shutdown #1501
• Full changelog

cluster-ingress-operator

• NO-JIRA: Add new NID team members to OWNERS #1317
• OCPBUGS-66135: Implement HTTPKeepAliveTimeout tuning option #1312
• OCPBUGS-66204: Implement ClosedClientConnectionPolicy field #1314
• OCPBUGS-65664: IngressOperator not exposing some metrics for degraded… #1305
• Full changelog

cluster-kube-apiserver-operator

• OCPBUGS-79419: : Always set service-account-jwks-uri to LB URL even with custom issuer #2078
• OCPBUGS-77005: scc: restricted-v3: Fix runAsUser range #1948
• OCPBUGS-74229: SCC: allow image volume type for all SCCs #2006
• OCPBUGS-65679: enable resource v1beta2 api if DynamicResourceAllocation is enabled #1929
• OCPBUGS-62057: OpenShift cluster got degraded after rotating the kube-apiserver-service-network-signer cert #1961
• OCPBUGS-64689: Add priority field to prevent early shutdown #1955
• OCPBUGS-55670: revert dev cert rotation #1906
• Full changelog

cluster-kube-controller-manager-operator

• OCPBUGS-64684: Add priority field to prevent early shutdown #890
• OCPBUGS-55217: Throttle resourcesynccontroller on pairs with dual writers. #882
• OCPBUGS-61323: CNTRLPLANE-1275:Fixing arch issue #870
• Full changelog

cluster-kube-scheduler-operator

• CNTRLPLANE-2843: chore: update OWNERS #620
• OCPBUGS-74337: Add OPERATOR_IMAGE_VERSION to recovery container #604
• OCPBUGS-74624: Add priority field to prevent early shutdown #586
• OCPBUGS-61544: add readonlyRootFilesystem #576
• Full changelog

cluster-kube-storage-version-migrator-operator

• OCPBUGS-61325: CNTRLPLANE-1306:Fixing arch issue #131
• Full changelog

cluster-machine-approver

• OCPBUGS-63587: port 9193 need to be internal and port 9194 need to have a service #280
• Full changelog

cluster-monitoring-operator

• OCPBUGS-74490: Include kube_pod_labels in minimal profile #2844
• OCPBUGS-77272: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2835
• OCPBUGS-74623: update expr for AlertmanagerClusterFailedToSendAlerts to exclude value 0 #2805
• OCPBUGS-67166: Add the collection of MTV migration metrics #2772
• OCPBUGS-62978: add tls configuration for the monitoring plugin deployment #2718
• OCPBUGS-62829: Remove cluster from non-multicluster dashboards #2701
• OCPBUGS-64577: Fix KSM deny-list typo #2729
• OCPBUGS-63408: chore(prometheus/remotewrite): [release-4.20] clarify that the in-cluster proxy env vars set in prometheus container can be used in all configs that support proxyConfig.proxyFromEnvironment #2721
• OCPBUGS-62979: Remove AlertManager endpoints when disabled #2710
• OCPBUGS-62750: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.20 #2692
• OCPBUGS-62308: test: remove image registry e2e tests #2686
• OCPBUGS-61680: add flag --watch-referenced-objects-in-all-namespaces to prometheus-operator #2667
• OCPBUGS-61207: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2661
• OCPBUGS-61166: Revert “MON-4343: Cleanup deprecate pa config” #2659
• Full changelog

cluster-network-operator

• OCPBUGS-77148: Add config override for openflow-probe #2918
• OCPBUGS-76349: Remove duplicated openssl parameter #2901
• CORENET-6311, OCPBUGS-74139: Skip running _stackmanager for libreswan 5.3+ #2872
• OCPBUGS-73365: fix(hypershift): use net.JoinHostPort for URL construction #2876
• OCPBUGS-66253: Add kubevirt platform to dual-stack supported platforms #2860
• OCPBUGS-66412: Fix whereabouts-token-watcher DaemonSet improvements #2850
• OCPBUGS-66164: [release-4.20] CORENET-6465: Remove unneeded logging config from managed ovn-kubernetes #2838
• OCPBUGS-66162: [release-4.20] CORENET-6488: Preserve custom resource requests on ovn-control-plane pods #2835
• OCPBUGS-46422: Add a ValidatingAdmissionPolicy blocking ServiceCIDR changes [4.20] #2827
• OCPBUGS-64733: api, l2udn: subnets must be masked #2823
• OCPBUGS-62678: Tweak iptables-alerter to try to avoid crictl bug #2811
• OCPBUGS-62273: Fix EgressIP stale GARP post reboot + pod restart #2806
• OCPBUGS-61779: Relax label req. of DPU/DPU Host/Smart NIC #2800
• OCPBUGS-61370: Set maxUnavailable 10% on MultiNetworkPolicy DS #2793
• Full changelog

cluster-node-tuning-operator

• OCPBUGS-78247: workloadhints: use IsVM to skip BM-only tests #1482
• OCPBUGS-70349: Remove CgroupModeV1 reference from the code #1437
• OCPBUGS-62721: E2E: skip SMT disabled test when L3 cache spans entire NUMA node #1404
• OCPBUGS-63751: PPC: ghw: filter out namespaces dir #1421
• OCPBUGS-64832: e2e:hugepages: changing tests to use hugepages-allocator tool #1427
• OCPBUGS-64588: e2e:llc: skip test when no BM worker is found #1422
• OCPBUGS-63010: E2E: Add test cases related to schedulable control plane nodes #1409
• OCPBUGS-62889: E2E: llc: make sure to remove any trailing newspaces #1408
• OCPBUGS-63334: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1415
• OCPBUGS-62214: E2E: Add function to check control plane nodes are schedulable. #1398
• OCPBUGS-62023: release-4.20: e2e: set of fixes/changes to ovs pinning testing #1394
• OCPBUGS-62017: E2E: llc: Create testing namespace before Runtime tests #1393
• And 1 elided commits (e.g. from squash or rebase merges)
• Full changelog

cluster-openshift-controller-manager-operator

• OCPBUGS-61607: set up openshift-tests-extension for cluster-openshift-controller-manager-operator and add a sanity test #396
• Full changelog

cluster-policy-controller

• OCPBUGS-62053: fix(psalabelsyncer): return an error instead of panic when converting an unknown volume #168
• Full changelog

cluster-samples-operator

• OCPBUGS-63507: references to github.com/sclorg/django-ex.git now also refer to the branch #655
• Full changelog

cluster-storage-operator

• OCPBUGS-75912: add vsphere permissions for checking if users is authorized to see metrics #663
• OCPBUGS-70343: volume-data-source-validator must use IfNotPresent image pull policy #653
• OCPBUGS-62668, OCPBUGS-62993: Move metrics to vsphere driver #630
• OCPBUGS-62175: add all-egress label to deployments on HCP and IBM #622
• OCPBUGS-61249: Fix logging e2e also faster cleanup #613
• Full changelog

cluster-version-operator

• OCPBUGS-74177: lib/resourcemerge/core: Reconcile ConfigMap binaryData too #1303
• OCPBUGS-64828: lib/resourcemerge: Add support for hostUsers flag #1259
• OCPBUGS-70180: [release-4.20] OCPBUGS-70180: Unify capitalization when comparing architectures for available updates #1281
• OCPBUGS-63001: Add ClusterVersionOperator manifests to TechPreviewNoUpgrade clusters in 4.20 #1247
• OCPBUGS-62867: temporarily disable metrics auth for hypershift clusters #1244
• Full changelog

console

• OCPBUGS-83420: Fix resource log dropdown TypeError #16282
• OCPBUGS-81678: Fix useOperatorCatalogCategories hook. #16251
• OCPBUGS-81322: Migrate InstallPlan components table to PatternFly Table #16217
• OCPBUGS-81439: Fix TypeError in OLS code import to console #16221
• OCPBUGS-81495, OCPBUGS-81496: OLM prompts for GCP Workload Identity parameters during Kiali Operato… #16231
• OCPBUGS-78295: Fix editing secrets with mixed text and binary data #16132
• OCPBUGS-78366: Clean up old session cookies to prevent accumulation #16136
• OCPBUGS-78839, OCPBUGS-79465, OCPBUGS-79466: apiVersion is empty on YAML creation page - Runtime error occurs when create MachineConfig with default yaml from… #16192
• OCPBUGS-76951: “Import from Git” should not force HTTPS/443 for Git providers (GitHub/GitLab/Bitbucket) #16029
• OCPBUGS-77951: Fix infinite recursion in project access form #16117
• CONSOLE-5011: migrate to yarn berry #16070
• OCPBUGS-76543: Use Actions button instead of kebab menu on Subscription details page #16018
• OCPBUGS-75880: Fix referenceFor parameter in SubscriptionDetailsPage #15987
• OCPBUGS-74696: Bump lodash to latest #15963
• OCPBUGS-74158: Do not resolve disabled catalog type extensions #15931
• OCPBUGS-72417: make cloudCredentials optional so operators load when … #15901
• OCPBUGS-67225: Remove unwanted semicolon from Serverless Channel and Broker list #15834
• OCPBUGS-69917: There should be no role ARN field as token-auth-aws/azure/gcp=false in csv annotations #15869
• OCPBUGS-73775: make cloudCredentials optional so operators load when … #15918
• OCPBUGS-69732: Fix Helm chart installation with CA/TLS certificates #15862
• OCPBUGS-70332: Visiting Group Detail Page > RoleBindings will show error #15887
• OCPBUGS-67136: Spread operand details across 2 col #15858
• OCPBUGS-66427: Update client initialization in checkPackageManifestHandler #15822
• OCPBUGS-67221: Disallowed Pipelines-plugin Pipelines navigation section #15833
• OCPBUGS-66248: The number of Quick Starts item is wrong #15797
• OCPBUGS-66206: Sync YAML editor modal settings #15787
• OCPBUGS-65900: Fix unnecessary rerenders with pod-connect #15758
• OCPBUGS-61785: Add validation and type guards on healthHandler calls to prevent errors #15500
• OCPBUGS-65793: OpenShift Console can only show user name instead of full name as the display name #15743
• OCPBUGS-65949: Add SDK-webpack 4.20 changelogs #15768
• NO-JIRA: Add SDK 4.20 changelogs #15765
• OCPBUGS-65761: Preserve query string in perspective switch + remove dev console folks from reviewers #15740
• OCPBUGS-64861, OCPBUGS-64863: Upgrade Helm to 3.18.5 #15705
• OCPBUGS-64702: Lack Chinese/Japanese/Korean translations for ‘On/Off’ switch button on editor setting modal of yaml page. #15683
• OCPBUGS-63125: use tenancy path for project scoped status card #15608
• OCPBUGS-61330: fix namespace path generation for non-namespaced resources #15498
• OCPBUGS-62953: Automatically redirect all-namespaces catalog to default namespace #15640
• OCPBUGS-64862: Convert standalone terminal route to extension #15702
• OCPBUGS-63499: Turn on fContentSecurityPolicyEnabled by default #15639
• OCPBUGS-64639: HPA Form View in RHOCP Web Console Incorrectly Requires Both CPU and … #15673
• OCPBUGS-63616: Preserve path on perspective switch #15650
• OCPBUGS-64809: Never allow OTHER_CATEGORY in categories #15690
• OCPBUGS-63608: Fix catalog search relevance scoring, so that operators with attribute.keywords are displayed and remove unnecessary metadataName from calculation #15648
• OCPBUGS-63470: limit node log length to 1000 lines #15635
• OCPBUGS-63440: Expose prometheus tenancy label path as a proxy #15632
• OCPBUGS-63465: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15634
• OCPBUGS-63403: Fix Bare Metal Hosts nav item #15628
• OCPBUGS-62644: bump dompurify to latest #15587
• OCPBUGS-61926: PVC shows negative Available space in OpenShift Console on RHOCP 4 #15512
• OCPBUGS-61861: cluster in workload identity mode is not applied with the token-auth-… #15507
• OCPBUGS-61848: Updation of label from edit label doesn’t work #15506
• OCPBUGS-62196: Add Missing Periods to Error Messages and update try again button link #15537
• OCPBUGS-62015: Help dropdown should be closed automatically after tour model opened #15519
• OCPBUGS-61990: Change default tab size from 4 to 2 #15515
• OCPBUGS-61671: i18n upload/download routine task for OCP version 4.20 #15485
• OCPBUGS-61777: Fix improper DescriptionList refactor #15499
• OCPBUGS-61327: Correct the ordering of Catalog categories to be alphabetized #15468
• OCPBUGS-61226: fix typo in update approval strategy label #15458
• Full changelog

console-operator

• OCPBUGS-77771: Add rhel8 and rhel9 oc binaries for Linux OS in CLI downloads #1122
• OCPBUGS-76267: Fix PDB blocking node drains during cluster upgrades + update donwloads deployment #1105
• OCPBUGS-69960: Reset StorageVersionMigrationDegraded condition #1085
• OCPBUGS-69654: Update path for browsing catalogs and operators in quickstarts. #1083
• OCPBUGS-64602: Remove v1alpha1 ConsolePlugin version from CRDs status #1060
• OCPBUGS-61230: pluginOrder field should only contain available plugins #1040
• Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

• OCPBUGS-74890: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 #368
• OCPBUGS-64811: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.33 into release-4.20 #355
• Full changelog

csi-external-resizer

• OCPBUGS-61546: Requeue PVC over PV creation #172
• Full changelog

csi-node-driver-registrar

• OCPBUGS-62844: update log level verbosity to not clutter logs #87
• Full changelog

docker-builder

• OCPBUGS-66991: bump buildah to 1.39.7 to fix CVE-2025-52881 #496
• OCPBUGS-64857: BuildConfig inline Dockerfile fails with heredoc syntax #483
• Full changelog

docker-registry

• OCPBUGS-68327: update logrus to v1.9.1 #462
• OCPBUGS-61638: update OWNERS #449
• Full changelog

driver-toolkit

• OCPBUGS-78783: Support ubi minimal base image #187
• Full changelog

etcd

• OCPBUGS-70151: 4.20 rebase 3.5.26 #358
• OCPBUGS-63474: 4.20 rebase 3.5.24 #347
• OCPBUGS-60874: Revert “OCPBUGS-52181: Ensure cluster id changes during force-new-cluster” #339
• OCPBUGS-57675: Updating ose-etcd-container image to be consistent with ART for 4.20 #334
• ETCD-726: Rebase etcd 3.5.21 openshift 4.19 #324
• OCPBUGS-52181: Ensure cluster id changes during force-new-cluster #313
• OCPBUGS-50510: Add configurable option for hardware-related timeout delay #311
• OCPBUGS-45488: Updating ose-etcd-container image to be consistent with ART for 4.19 #306
• ETCD-717: Rebase etcd 3.5.19 openshift 4.19 #315
• DOWNSTREAM: <carry>: OCPBUGS-51838: fix a compaction induce latency issue #309
• ETCD-709: Rebase etcd 3.5.18 openshift 4.19 #308
• OCPBUGS-44528: Rebase etcd 3.5.17 openshift 4.18 #302
• DOWNSTREAM: <carry>: ETCD-697: add tls min/max version to grpc proxy #301
• DOWNSTREAM: <carry>: ETCD-696: Add rev bumping to force-new-cluster #300
• NO-ISSUE: Add support for cachi2 based deps in Dockerfile.art #296
• NO-ISSUE: Add support for cachi2 based deps #294
• OCPBUGS-39188: Rebase etcd 3.5.16 openshift 4.18 #290
• NO-JIRA: use golang 1.22 image #285
• ETCD-656: Automate datadir move after quorum-restore #284
• DOWNSTREAM: <carry>: ETCD-653: add jq to the etcd image #282
• OCPBUGS-34653: Rebase etcd 3.5.14 openshift 4.17 #273
• CORS-3191: DOWNSTREAM <carry>: add native binary to installer images #269
• CORS-3249: DOWNSTREAM <carry>: installer: make etcd binaries static #268
• CORS-3249: DOWNSTREAM <carry>: add installer Dockerfile for ART builds #267
• OCPBUGS-31624: Rebase etcd 3.5.13 openshift 4.16 #259
• no-issue: Update Installer dockerfile to use golang-1.20 #251
• OCPBUGS-28730: Rebase etcd 3.5.12 openshift 4.16 #242
• CORS-3191: Add Dockerfile to build etcd for openshift-installer #249
• OCPBUGS-24988: Updating ose-etcd-container image to be consistent with ART #236
• OCPBUGS-24931: Rebase etcd 3.5.11 openshift 4.16 #237
• OCPBUGS-19279: Updating ose-etcd images to be consistent with ART #215
• OCPBUGS-20560: [4.15] Rebase openshift/etcd to 3.5.10 #224
• OCPBUGS-18179: UPSTREAM <carry>: update build images to rhel9 #211
• OCPBUGS-11850: Rebase etcd-3.5.9 into openshift-4.14 #203
• OCPBUGS-11850: Rebase etcd-3.5.8 into openshift-4.14 #201
• Update owners #184
• Updating ose-etcd images to be consistent with ART #182
• Updating ose-etcd images to be consistent with ART #181
• OCPBUGS-5458: UPSTREAM:<carry>: etcdserver: process the scenaro of the last WAL rec… #175
• OCPBUGS-3098: Rebase openshift/etcd 4.13 onto v3.5.6 #168
• Bug OCPBUGS-3098: UPSTREAM: <carry>: server/etcdmain: add configurable cipher list to gRPC proxy listener #162
• OCPBUGS-861: Rebase openshift/etcd 4.12 onto v3.5.5 #144
• Updating ose-etcd images to be consistent with ART #134
• Bug 2085997: increases cluster discovery time from 10s to 135s #131
• Revert “UPSTREAM: <carry>: increases cluster discovery time from 10s to 180s” #130
• Bug 2085997: increases cluster discovery time from 10s to 180s #129
• Add new members to reviewers/approvers #121
• Remove MemberList patch #120
• 3.5.3 with history #116
• Contiguous to 3.5.2 #109
• OWNERS: bump #104
• UPSTREAM: <carry>: add –experimental-max-learner flag #102
• OWNERS: clean up #101
• Bug 2003775: UPSTREAM: <carry>: server: Fix for v3.5 Ensure that cluster members stored in v2store and backend are in sync #98
• UPSTREAM: <carry>: storage/backend: Add a gauge to indicate if defrag is active #97
• Updating ose-etcd images to be consistent with ART #95
• Bug 1994986: (CARRY) etcdctl/ctlv3/ctl.go: Remove check perf command #94
• Bug 1992673: Fix build #93
• ETCD-203: Updating ose-etcd images to be consistent with ART #92
• ETCD-202: bump etcd v3.5.0 #91
• ETCD-200: Bump etcd v3.4.16 to go 1.15 #86
• Updating ose-etcd images to be consistent with ART #87
• ETCD-199: bump etcd v3.4.16 #83
• Updating ose-etcd images to be consistent with ART #84
• Bug 1958913: discover-etcd-initial-cluster: retry if member is not part of member list and dataDir exists #81
• Bug 1958405: UPSTREAM: <carry>: etcdserver/api/etcdhttp: log successful etcd server side health check in debug level #80
• Bug 1958405: UPSTREAM: <carry>: *: log server-side /health checks #79
• Bug 1958405: UPSTREAM: <carry>: server: add support for log rotation (#12774) #78
• UPSTREAM: <carry>: *: ensure zap logger is set before use #75
• ETCD-180: Bug 1927942: UPSTREAM: <carry>: *: add support for socket options #70
• ETCD-178: Bug 1931652: openshift-tools: fix on off flow and add unit tests #73
• Updating ose-etcd builder & base images to be consistent with ART #68
• Bug 1870189: Bump v3.4.14 #65
• OWNERS: add component #60
• Updating ose-etcd builder & base images to be consistent with ART #59
• Bug 1878163: Updating ose-etcd builder & base images to be consistent with ART #57
• Bug 1883772: discover-etcd-initial-cluster: improve error handling when we dont scale member #56
• Bug 1859196: bump etcd v3.4.9 #52
• Bug 1814576: make evaluation of targetMember strict #48
• *: bump etcd to v3.4.7 #44
• list all peers in initial-cluster #38
• Bug 1808544: If we weren’t able to get client or target member go ahead and start … #36
• Bug 1808073: fix archive member name, unmask error #34
• Bug 1806751: Archive data-dir if target member is unstarted #29
• Use var lib etcd as data dir #30
• Bug 1805807: create logic for golang ETCD_INITIAL_CLUSTER #28
• add stub discovery-etcd-initial-cluster #26
• Bug 1801237: *: bump etcd to v3.3.18 #21
• : bump etcd to v3.3.17 #20
• Dockerfile: bump golang 1.12 #19
• BUG 1747124: Dockerfile: use build instead of make build #17
• Dockerfile: bump golang to 1.11 #14
• Bug 1706103: Dockerfile: set coreos org as canonical for release-3.3 #12
• [cherry-pick openshift-4.0] *: Change gRPC proxy to expose etcd server endpoint /metrics #6
• Dockerfile: resolve issue where binary was not properly copied #5
• clientv3: automated cherry pick of #10153 to release-3.3 #10161
• Automated cherry pick of #9997 #10041
• etcdctl: cherry pick of #10109 to release-3.3 #10122
• etcdserver: remove duplicated imports #10093
• etcdserver: cherry-pick #9861 to release-3.3 #10027
• Automated cherry pick of #9990 #10004
• Automated cherry pick of #9761 #9940
• And 206 elided commits (e.g. from squash or rebase merges)
• Full changelog

gcp-cloud-controller-manager

• OCPBUGS-77152: Fix ose gcp cloud controller manager hermetic #97
• Full changelog

haproxy-router

• OCPBUGS-78435: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.20 #750
• OCPBUGS-78432: Updating ose-haproxy-router-base-container image to be consistent with ART for 4.20 #749
• OCPBUGS-79529: Lower verbosity for parseIPList empty list logging #753
• OCPBUGS-66204: Add option abortonclose to HAProxy configuration template #695
• OCPBUGS-61558: Revert Prevent startup failures due to name resolution” #674
• Full changelog

hyperkube, kube-proxy, pod

• NO-JIRA: UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS #2638
• OCPBUGS-77476: Rebase v1.33.9 to release-4.20 #2614
• OCPBUGS-76517: Bump 1.33.8 #2595
• OCPBUGS-74977: UPSTREAM: 136595: raise kubelet CSI init backoff to cover ~140s DNS delays #2581
• OCPBUGS-61843: UPSTREAM: 131850: cpumanager: uncorecache alignment for odd integer cpus #2498
• OCPBUGS-65551: Bump 1.33.6 #2518
• OCPBUGS-46422: Remove patch/update from ServiceCIDR API conformance test #2466
• NO-JIRA: enable CBOR tests #2502
• OCPBUGS-63601: UPSTREAM: <carry>: Skip CPU resource status for workload-partitioning #2504
• OCPBUGS-61555: Bump 1.33.5 #2461
• OCPBUGS-61753: UPSTREAM: <carry>: Add retries for GetCurrentResourceVersion. #2469
• OCPBUGS-61720: Do not remove PVC ClaimRef to fix flaky VAC test #2463
• OCPBUGS-61197: UPSTREAM: 133425: Fix SELinux label comparison #2445
• OCPBUGS-61347: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2450
• OCPBUGS-61333: Unrevert bump to v1.33.4 #2449
• Full changelog

hypershift

• OCPBUGS-82069: OCPBUGS-81670: fix(cpo-v2): preserve HCCO modifications to OCM Controllers field #8177
• OCPBUGS-78474: Fix deadlock when changing release image during initial provisioning #7953
• OCPBUGS-81746: Honor AWS AMI override in NodePool token generation #8183
• OCPBUGS-80950: fix(cpo): Don’t remove HCP Ingress from routes when CapabilityRoute is disabled #8083
• OCPBUGS-78979: fix(hostedcluster): Remove referenced resource annotations regardless of hcp status #8023
• CNTRLPLANE-3008: Azure web identity webhook 4.20 #7998
• OCPBUGS-78741: fix(sync-global-pullsecret): compare content ignoring trailing newlines #7976
• CNTRLPLANE-2814: feat(aro): Swift support #7885
• OCPBUGS-76992: fix kubevirt, use 100.66.0.0/16 for join subnet #7733
• OCPBUGS-78305: Fix context cancel accumulation in getMirrorFromICSPOrIDMS #7890
• OCPBUGS-76324: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7660
• OCPBUGS-77366: Fix ignition-server pod restarts #7842
• OCPBUGS-75931: [release-4.20] fix(cpo): Correct route labeling logic for HCP router infrastructure #7642
• OCPBUGS-74105: Fix CVE-2025-58183 #7546
• CNTRLPLANE-2680: Add support for setting max expiration duration for KAS service account tokens #7707
• OCPBUGS-74775: feat(cpo): check components are available before setting HostedCluster available #7616
• OCPBUGS-72409: fix(Portieris): Fix Portieris by mounting emptyDir to ‘./.trust’ work dir #7421
• OCPBUGS-73365: fix(cno): use brackets only for IPv6 in server URL #7461
• OCPBUGS-72405: Fix Konflux EC voilation, update deprecated base … #7444
• OCPBUGS-66409: test: Fix control plane components rollout failure when NetworkType is not OVNKubernetes #7337
• CNTRLPLANE-2205: fix(hcco): allow for ARN reuse across components #7383
• OCPBUGS-69378: test: remove network-dependent unit tests for image metadata #7391
• OCPBUGS-66397: fix(kas): apply LoadBalancerSourceRanges only for LoadBalancer service type #7336
• NO-JIRA: Update expected digest for busybox:latest in TestGetDigest #7350
• CNTRLPLANE-1710: feat(globalps): security enhancements on GlobalPullSecret feature #7234
• OCPBUGS-65576: add hypershift-no-cgo to the latest operator conta… #7229
• CORENET-6484: Restart ovnkube-control-plane pods when restart-date annotation is set #7190
• OCPBUGS-63509: fix(ingress): add LoadBalancerSourceRanges support for external router service #7098
• OCPBUGS-64848: feat: Promote ExternalOIDCWithUIDAndExtraClaimMappings feature to GA for Hypershift #7204
• OCPBUGS-61774: fix(capi-provider): use single replica deployment for aws and azure #6834
• CNTRLPLANE-1908: control-plane-operator-4-20 Konflux pipelines #7216
• OCPBUGS-63539: remove NTO Service and ServiceMonitor #7099
• OCPBUGS-63718: specify SCC annotation for pods in data plane #7132
• OCPBUGS-63128: resolve initContainer permission issue after node reboot #7080
• OCPBUGS-63604: fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7107
• OCPBUGS-63367: FIPS compliant hypershift binary #7083
• OCPBUGS-62020: fix(security): harden konnectivity-agent DaemonSet security context #6870
• OCPBUGS-62806: Fix driver-config ConfigMap content flapping due to random ordering #6945
• OCPBUGS-63387: fix: routes are not used in case of IBM Cloud #7079
• CNTRLPLANE-1648: Remove main-branch build pipelines from release-4.20 #7050
• OCPSTRAT-2472: Add latest tag to MCE 2.10 build pipeline #6912
• OCPBUGS-62182: fix(kas-bootstrap): increase wait timeouts to avoid KAS startup races #6887
• OCPBUGS-62005: Enable VolumeAttributesClass runtime config #6868
• OCPBUGS-62006: fix(ignition-server): Don’t delete user-managed cert secrets #6869
• OCPBUGS-61863: ci: Use the common MCE konflux pipeline #6847
• OCPBUGS-61066: fix: propagate AWSLoadBalancerTargetNodesAnnotation to HCP #6772
• OCPBUGS-61575: fix(kas): Set correct container port in postStart handler, 2 #6854
• OCPBUGS-61565: [release-4.20] fix(proxy): ensure URLs have scheme before proxy resolution #6791
• OCPBUGS-61746: fix(oauth): oauth-openshift deployment should be HA #6828
• OCPBUGS-56778: fix(kas): Disable PSA enforcement in 4.20 #6830
• CNTRLPLANE-1397: feat(konflux): tag MCE HO images with latest #6784
• OCPBUGS-61670: fix(control-plane): remove resource limits from kube-controller-manager #6804
• OCPBUGS-61667: resolve MIRRORED_RELEASE_IMAGE flapping #6803
• OCPBUGS-61321: rename CCM deployments to align with 4.19 #6768
• OCPBUGS-61322: fix: cleanup old PKI operator deployment during upgrades #6769
• Full changelog

ibm-vpc-block-csi-driver

• OCPBUGS-77205: [release-4.20] standardize build paths #120
• Full changelog

ibmcloud-machine-controllers

• OCPBUGS-81317: bump vpc go sdk #89
• NO-JIRA: Modernize test infrastructure to align with other MAPI providers #85
• Full changelog

insights-operator

• OCPBUGS-80641: Bump google.golang.org/grpc to v1.79.3 (Revamp #1261) #1267
• OCPBUGS-76961: Extends the time for the extractor liveness probe #1231
• OCPBUGS-74902: set Progressing condition on cluster update #1219
• OCPBUGS-75114: [bugfix] The ConfigMap value for StoragePath is ignored on basic routine #1222
• OCPBUGS-64107: [release-4.20] Patch for GO-2025-4014 #1215
• OCPBUGS-66062: Add filtering to add other possible pod status to QEMU gatherer #1185
• OCPBUGS-64800: QEMU logs are not gathered if there are pending status virt-launcher pods #1174
• OCPBUGS-65660: [bugfix] The archive’s records may include files whose names are out of bounds #1177
• OCPBUGS-62019: update DataGather condition when gathering job fails #1155
• OCPBUGS-61784: Update error message for missing SCA certificates #1139
• OCPBUGS-61845: add missing permissions for replicasets and events #1144
• And 2 elided commits (e.g. from squash or rebase merges)
• Full changelog

insights-runtime-exporter, insights-runtime-extractor

• OCPBUGS-77566: remove dnf cache from the container images #66
• Full changelog

ironic

• OCPBUGS-74405: Update sushy to include DGX B200 credentials fix #820
• OCPBUGS-74117: Bump keystonemiddleware version to 10.9.0-0.20260216145500.557d173 for CVE-2026-22797 fix #792
• OCPBUGS-77264: fix for minimal builds #800
• OCPBUGS-76539: Update ironic hash for 4.20 with heartbeat inspection fix #788
• Bug OCPBUGS-76547: Bump 4.20 ironic-image to include firmware update fixes #787
• OCPBUGS-69786: Bump eventlet version #756
• METAL-1695: OKD: install Ironic from the OpenShift fork #740
• OKD-304: Fix python dependencies for OKD #731
• OCPBUGS-64850: Handle HTTP 400 and 409 race condition in Redfish power operations #720
• OCPBUGS-64820: Fix IPA external inspection callback url override #713
• OCPBUGS-52427: Bump ironic and sushy to fix idrac10 #698
• OKD-290: (OKD4.20) Fix ironic-image errors and metal3 pod crashes on CentOS9 #696
• OCPBUGS-61461: revert the switch to local RPC #690
• OCPBUGS-61257: set [json_rpc]port unconditionally #686
• Full changelog

ironic-agent

• OCPBUGS-77264: fixes for minimal builds #244
• OCPBUGS-69777: Bump eventlet version #228
• OCPBUGS-66934: Filter out more USB network devices #221
• OCPBUGS-66084, OKD-295: Fix broken OKD ironic-agent-image #216
• OCPBUGS-65519: Include Test advertised ip reachability before assigning it #212
• Full changelog

kube-state-metrics

• OCPBUGS-72589: fix: only close existing channels #128
• Full changelog

kubevirt-cloud-controller-manager

• OCPBUGS-74100: [4.20] sync upstream 2026-01-27 #62
• Full changelog

kubevirt-csi-driver

• OCPBUGS-79064: Add annotation-based fallback for infra VM node ID resolution #84
• OCPBUGS-78371: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.20 #78
• Full changelog

machine-api-operator

• OCPBUGS-78424: [release-4.20] Use resource group when generating default Azure image #1475
• OCPBUGS-61853: Fixed multi nic e2e to wait for node removal after machineset tests #1418
• OCPBUGS-61853: Adjusted machine e2e tests to wait for nodes to clean up #1416
• OCPBUGS-61314: bump openshift/api #1410
• Full changelog

machine-config-operator

• OCPBUGS-80947: Skip boot image updates until cluster is stable #5812
• OCPBUGS-79370: Re-order logger setting to eliminate race condition #5791
• [release 4.20] OCPBUGS-77252: Calculate machine counts in MCP status from node properties #5692
• OCPBUGS-79577: Update AMI Whitelist #5806
• OCPBUGS-79371: set default-timeout-stop to 200s globally #5792
• OCPBUGS-78049: install/0000_80_machine-config_04_kube_rbac_proxy_config: Consistent terminal newline #5753
• OCPBUGS-77883: Fix failure domain matching during vsphere boot image updates #5745
• OCPBUGS-77950: Update AMI Whitelist #5748
• OCPBUGS-77665: Update AMI Whitelist #5731
• OCPBUGS-77064: reduce MCO image size #5673
• OCPBUGS-77472: Clean up vsphere login error logging #5715
• OCPBUGS-77369: Remove MCD liveness probe #5707
• OCPBUGS-77181: mcd_config_drift not working properly #5684
• OCPBUGS-76921: Prevent unnecessary systemd unit disable #5664
• OCPBUGS-77008: Machine-config controller should not log about non-existent pull-secret changes #5668
• OCPBUGS-74433: Set NodeDegraded MCN condition when node state annotation is set to Degraded #5649
• OCPBUGS-76339: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5631
• OCPBUGS-76361: Update AMI script and list #5641
• OCPBUGS-74146: enable nodeip-configuration for platform external #5580
• OCPBUGS-74298: Fix up bootstrap-e2e #5590
• OCPBUGS-73884: pkg/controller/container-runtime-config: admin_ack handling for 4.20-to-4.21 OCI mirror requirement #5558
• OCPBUGS-73776: Fix timeout during configMap cleanup #5557
• OCPBUGS-74081: Enable existing units without content #5565
• OCPBUGS-66260: Set -fin timeouts in HAProxy config #5459
• OCPBUGS-70201: ctrcfg: set increase ulimits when upgrading from 4.20 to 4.21 #5516
• OCPBUGS-69706: Fix keepalived SIGTERM handling #5507
• OCPBUGS-70322: Skip boot image updates if arch annotation is not found #5525
• OCPBUGS-70349: Remove the dead code of setting the operator status for cgroupv1 based clusters #5446
• OCPBUGS-69666: Remove log exposing kubeconfig #5505
• OCPBUGS-69444: MCP is not correctly degraded when a pivotError happens #5503
• OCPBUGS-65545, OCPBUGS-67007: cherry pick to few fixes that needed for missing services and configuration #5480
• OCPBUGS-67137: Fix cleanup in TestInstallRPMAndCheckMCDMetrics to decrease risk of test failures due to interference #5478
• OKD-294: Migrate runtime from runc to crun on an upgrade for OKD #5467
• OCPBUGS-65898: fixes systemd unit creation for empty units #5437
• OCPBUGS-64822: block upgrades for conflict non-default ClusterImagePolicy resources #5414
• OCPBUGS-65777: Enforce OCP 4.20 and earlier cluster to have AutoSizingReserved disabled by default #5387
• OCPBUGS-65781: Remove –mount directives #5425
• OCPBUGS-65556: [release-4.20] Backport: Add delays to reduce TestOSBuildController failures #5396
• OCPBUGS-64822: remove check for conflicting ClusterImagePolicy in syncUpgradeableStatus #5413
• OCPBUGS-65509: e2e gcp ocl PR backport #5407
• OCPBUGS-64822: Implement upgrade blocking for conflicting ClusterImagePolicy named “openshift” #5397
• OCPBUGS-59766: Update timing of MCN desired config spec update to align with node annotation setting #5367
• OCPBUGS-64656: Update the OCP base image in Dockerfile to 4.20 reference #5392
• OCPBUGS-63534: Create temporal allow policy #5373
• OCPBUGS-62167: Fix - NetworkManager restart or crash renders br-ex unusable #5353
• OCPBUGS-63127: Ensure the node passed to RunCordonOrUncordon comes from the latest updated state #5349
• OCPBUGS-63337: RHEL10 RT kernel packages filtering #5365
• OCPBUGS-62801: Only fire OSImageURLOverridden and set metrics on changes #5339
• OCPBUGS-62273: Networking: reset ovn-remote config and allow ovnkube controller to s… #5317
• OCPBUGS-62803: Skip rpm-ostree local rebase if no PIS #5340
• OCPBUGS-62095: CRI-O: set hard/soft file descriptor ulimits to 1048576 #5308
• OCPBUGS-62174: Fix MCP updated machine count for image mode disabling case #5307
• OCPBUGS-62675: Cert Controller should live fetch SAN IPs during cert rotation #5326
• OCPBUGS-62602: configure-ovs: work around a Cisco switch issue #5321
• OCPBUGS-62080: Add mcd_local_unsupported_packages recording rule #5297
• OCPBUGS-61882: Add nil/null checks to image registry secret decode #5292
• OCPBUGS-62073: Improve MCN CRD clean-up script #5296
• OCPBUGS-61516: Machine-config controller should actively manage cordon while draining #5281
• OCPBUGS-61824: Override NMState service definition #5286
• OCPBUGS-61232: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5273
• Full changelog

machine-image-customization-controller

• OCPBUGS-81296: Return error when network data Secret lacks nmstate key #172
• OCPBUGS-77496: Clean up dnf cache to reduce container image size #165
• Full changelog

machine-os-images

• OCPBUGS-71203: Backport multi arch fixes #77
• Full changelog

metallb-frr

• OCPBUGS-65516: [release-4.20] Dockerfile: unpin FRR rpm #111
• Full changelog

monitoring-plugin

• OCPBUGS-82440: fix: re encode params when redirecting from graph to query-browser #872
• OCPBUGS-77406: bump koa #866
• OCPBUGS-78359: fix for CVE-2025-69873 #846
• OCPBUGS-78425: Updating monitoring-plugin-container image to be consistent with ART for 4.20 #843
• OU-1062: [release-4.20] feat: mark alert menu active for incidents tab #826
• OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9: Axios affected by Denial of Service via proto Key in mergeConfig #796
• NO-JIRA: [release-4.20] e2e-monitoring fixing loop on legacy dashboard #830
• NO-JIRA: [release-4.20] simplify dockerfile by removing cachito dependencies #807
• revert #780 #792
• OCPBUGS-76581: [release-4.20] CVE-2026-25639 openshift4/ose-monitoring-plugin-rhel9:Axios affected by Denial of Service via proto Key in mergeConfig [openshift-4.20] #780
• OCPBUGS-76613: [release-4.20] fix: update vulnerable dependencies #766
• OCPBUGS-73842: fix: update qs vulnerable dependency #733
• NO-JIRA: [release-4.20] fix: remove unnecessary package.lock #732
• OU-1146: remove random multiplication #704
• OU-1135: [release-4.20] monitoring testing backport #700
• OCPBUGS-69725: [release-4.20] fix: upgrade node-forge vulnerable dependency #701
• OU-1130: Merge main to release 4.20 #683
• OCPBUGS-66389: Time range and Refresh interval dropdown button lack of unique identifier #668
• OCPBUGS-66240: configure max TLS version only when specified #664
• OCPBUGS-65947: add missing conversion units #654
• OCPBUGS-63440: fetch metric labels with tenancy #617
• OCPBUGS-63162: [release-4.20] Improve alignment with console SDK #604
• OCPBUGS-62978: allow additional TLS config #592
• Full changelog

multus-cni, multus-cni-microshift

• OCPBUGS-73737: Fix server url in kubeconfig #273
• OCPBUGS-73888: update ci-operator.yaml #274
• Full changelog

multus-networkpolicy

• OCPBUGS-77548: Clean up dnf cache #102
• Full changelog

networking-console-plugin

• OCPBUGS-77226: Fix NAD creation using default namespace instead of selected one #350
• CNV-77540: fix Enable MultiNetworkPolicies lead to invalid URL #342
• CNV-76277: Fix name generator with unprofessional names #317
• CNV-72230: fix networking links #308
• OCPBUGS-66335: fix flickerying in synced editor #304
• CNV-72771: fix null error #300
• CNV-71965: replacing the broken link to VirtualMachine network docs #298
• Hide VirtualMachine networks page in 4.20 release #290
• Full changelog

oauth-apiserver

• NO-JIRA: (chore): update OWNERS file #168
• OCPBUGS-63052: (bugfix): useroauthaccesstokens: cast delete validation object to correct type for admission #151
• OCPBUGS-61753: Bump openshift/kubernetes-apiserver. #147
• Full changelog

oauth-proxy

• OCPBUGS-74132: test/e2e - do not use ambiguous container image short names #345
• Full changelog

oauth-server

• OCPBUGS-77500: groupmapper: avoid mutating original group users slice when removing user #214
• OCPBUGS-68330: go.mod: bump logrus from v1.9.0 to v1.9.3 to fix CVE-2025-65637 #209
• Full changelog

oc-mirror

• OCPBUGS-77416: Fix registriesd “unknown userid” failure for arbitrary UIDs #1360
• OCPBUGS-76630: Fix reg config detection for explicit false values #1350
• OCPBUGS-76949: fix conversion issue for catalog #1353
• OCPBUGS-75007: [release-4.20] fix duplicated channel bug in filtered catalogs #1347
• OCPBUGS-64647: fix: return only requested version #1306
• OCPBUGS-65787: Remove empty status field from generated IDMS/ITMS files #1313
• OCPBUGS-63030: removes unintended exec permissions #1291
• OCPBUGS-62463: generate the archive only after mirroring #1279
• OCPBUGS-62283: v2/cli: show binary version in output #1276
• And 4 elided commits (e.g. from squash or rebase merges)
• Full changelog

olm-catalogd, olm-operator-controller

• OCPBUGS-61890: 🐛 CRD upgrade safety fixes and ratcheting (#2123) #527
• NO-ISSUE: add jiazha to approvers #513
• OCPBUGS-62811: for incompatible test add func to wait builder and deployer SA creation by OCP controller #503
• OCPBUGS-62722: (cherry-pick) Fix truncate large error messages and unhandle changes for crd upgrade safety in status conditions #496
• OCPBUGS-61705: Revert “Handle service-ca cert availability/rotation” #474
• OCPBUGS-61563: [OTE] Update webhook ote tests to use latest webhook-operator #469
• Full changelog

openshift-apiserver

• OCPBUGS-65848: Add ValidatingAdmissionPolicy and check for omissions next time. #577
• OCPBUGS-61982: pkg/image: conditionally parse raw image manifest #559
• OCPBUGS-65814: update pkg/image/OWNERS #575
• OCPBUGS-61753: Bump openshift/kubernetes-apiserver. #557
• OCPBUGS-61494: ensure cache invalidation after a time #553
• Full changelog

openshift-controller-manager

• OCPBUGS-61900: Fix Dockerfile.rhel: Add OTE binary build and packaging for release-4.20 #420
• OCPBUGS-61790: CNTRLPLANE-1308: set up openshift-tests-extension for openshift-controller-manager and add a sanity test #418
• Full changelog

openstack-cluster-api-controllers

• OCPBUGS-64814: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 #381
• OCPBUGS-64814: Fix verify step #389
• Full changelog

openstack-machine-api-provider

• OCPBUGS-69645: Don’t record event for every reconcile #145
• OCPBUGS-76790: Fix make test #157
• OCPBUGS-74226: Revendor CAPO #148
• Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

• OCPBUGS-79681: Fix nil pointer dereference in sortUnpackJobs when sorting non-failed jobs #1267
• OCPBUGS-81292: add jiazha to approvers #1269
• OCPBUGS-77958: Update NetworkPolicy egress for HyperShift custom API ports #1253
• OCPBUGS-77230: Remove the collect-profiles info from the microshift kustomization file #1236
• OCPBUGS-76335: Remove the collect-profiles job #1223
• OCPBUGS-62014: rorfs for cacheless lacks write access to /tmp/ to generate cache #1170
• OCPBUGS-64724: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1139
• OCPBUGS-61362: [4.20] e2e stability fixes #1077
• Full changelog

operator-marketplace

• OCPBUGS-77582: Update NetworkPolicy egress to support HyperShift custom API ports #730
• OCPBUGS-73876: Update default catalog polling interval to 4h (240m) #708
• OCPBUGS-65680: enforce client side auth requirement for metrics endpoint #688
• OCPBUGS-62216: Remove Expect func so that the test case can use the retry logic #667
• OCPBUGS-61200: Add NetworkPolicy for hypershift #660
• Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

• OCPBUGS-79537: EgressFirewall: Use exponential backoff to refresh IP addresses for DNS names #3088
• OCPBUGS-77148: Minimize ACLs by combining ipBlocks into single ACL #2981
• OCPBUGS-77357: Clear stale conntrack UDP entries for nodePorts #3012
• OCPBUGS-77081, OCPBUGS-77094: [release-4.20] combined backport PR for 2 escalations #2985
• OCPBUGS-73788: Fix service flows for BGP on IPV6 #2934
• OCPBUGS-74268: release-4.20 fix(localnet, ipamless): Prevent LSP deletion on sync #2941
• OCPBUGS-66049: Fix conntrack reconciliation to use service port instead of endpoint port #2874
• OCPBUGS-64836: back-port IP & MAC conflict detection #2827
• OCPBUGS-65514: [4.20] status manager: remove managedFields for deleted zone upon zone deletion #2855
• OCPBUGS-65951: [release-4.20]: Fix linter issues, add missing cheryy-pick bits of #2844 #2866
• OCPBUGS-65618: [release-4.20] OCP4: 4.18.22 EgressIP Failover does not succeed - extended downtime and no reassignment between egress-capable peers #2865
• OCPBUGS-65605: add lint target to run golanci natively #2856
• OCPBUGS-64697: [release-4.20] Referencing pod named ports within a service results in bad DNAT rules containing tcp/0 target port #2844
• OCPBUGS-63686: Fix stale EIP assignments during failover and controller restart #2835
• OCPBUGS-64590: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2841
• OCPBUGS-63696: Fixes OF flows to be VLAN aware as well as add DPU checks for certain features #2837
• OCPBUGS-63007: kubevirt: fix bad release of IPs of live migratable pods #2801
• OCPBUGS-63577: [release-4.20] CORENET-6055: Dockerfile: Unpin OVN and consume the latest from FDP. #2808
• OCPBUGS-63631: Skip Pending pods in EgressIP status updates #2831
• OCPBUGS-62913: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2797
• OCPBUGS-62273: Fix EgressIP stale GARP post reboot + pod restart #2767
• OCPBUGS-61453: [4.20] allow default network -> localnet on the same node for any localnet subnet #2751
• OCPBUGS-62336: Fix EgressIP controller deadlock by sorting node locks lexicographically #2770
• OCPBUGS-61239: Skip node-encap-ips annotation in DPU host mode #2763
• OCPBUGS-61778: Adding ovndb-raft-functions.sh to ovnk image #2760
• Full changelog

powervs-block-csi-driver

• OCPBUGS-75818: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #113
• Full changelog

powervs-block-csi-driver-operator

• OCPBUGS-80676: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #108
• OCPBUGS-75820: Mitigate CVE-2025-61726 by bumping golang to 1.24.13 #105
• Full changelog

prometheus

• OCPBUGS-78582: [release-4.20] chore(kubernetes): deduplicate warning logs from the API #299
• OCPBUGS-62275: chore(scrape): default to legacy validation/escaping scheme until utf-8 is fully supported by prometheus-operator #273
• OCPBUGS-61207: chore: compute highestTimestamp at queryManager level #264
• Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

• OCPBUGS-77296: backport upstream fix to reconcile resources with inconsistent status #367
• OCPBUGS-77190: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #362
• Full changelog

prometheus-node-exporter

• OCPBUGS-63624: bump github.com/prometheus/procfs to v0.16.1 #173
• Full changelog

route-controller-manager

• OCPBUGS-76957: filter ingress namespace on UnmanagedRoutes metric #74
• Full changelog

service-ca-operator

• OCPBUGS-61966: don’t hotloop on secret creation errors #275
• Full changelog

tests

• : run resource request/limit check early #30888
• OCPBUGS-78025: Skip oauth test for external control plane topology #30848
• OCPBUGS-78084: Update optimized builds test to use rpm -qa instead of dnf #30861
• OCPBUGS-78084: Allow test to tolerate running on minimal images #30853
• OCPBUGS-77824: add the missing namespace from managed openshift #30837
• OCPBUGS-77776: Update MCN tests to better handle condition transitions through the “Unknown” state #30829
• OCPBUGS-72395: Unrevert TLS tests with fixes #30668
• OCPBUGS-72412, OCPBUGS-72413: only run Netpol two at a time #30666
• OCPBUGS-69686: BeforeEach was indirectly called in DetermineReleasePayloadImage #30620
• OCPBUGS-66072: [release-4.20] net(virt) remove virtctl if not correctly retrieved #30538
• OCPBUGS-64836: back-port IP & MAC conflict detection e2e tests #30414
• OCPBUGS-66963: Fix MachineConfigNode test in two-node fencing clusters #30540
• OCPBUGS-66365: update watch request limits for marketplace-operator #30569
• OCPBUGS-66979: Revert “OCPNODE-3912: Add a test for NodeSizing default change to OCP 4.20” #30582
• OCPNODE-3912: Add a test for NodeSizing default change to OCP 4.20 #30467
• OCPBUGS-64777: [release-4.20] Add e2e tests for storage network policy #30468
• OCPBUGS-46422: Add test that the ServiceCIDR API is blocked [4.20] #30434
• OCPBUGS-63656: Redact bearertoken in TestContext #30435
• OCPBUGS-64598: Updated the upgrade duration limit to 100 minutes for ppc64le #30451
• OCPBUGS-64593: [release-4.20] NO-JIRA: Filter preconfiguredIPs based on cluster IP family support #30415
• OCPBUGS-63725: CNTRLPLANE-1766:fix(disruption): Using correct internal LB of apiserver for monitor test on ARO and Baremetal Hypershift #30439
• OCPBUGS-63171: Add imagestream update dryrun test #30389
• OCPBUGS-63513: Migrate OCP-32383 to upstream #30423
• OCPBUGS-62841: fix(test): prevent nil pointer dereference in ginkgo test runner #30350
• OCPBUGS-46422: Skip ServiceCIDR in etcd_storage_path test (4.20) #30257
• OCPBUGS-62695: cherry-pick 30270 to release-4.20 #30335
• OCPBUGS-62231: network test isolation and reduced parallelization to protect cpu #30300
• Revert “[release-4.20] OCPBUGS-62140:OCPSTRAT-2045:Automating OCPSTRAT-2045 feature in upstream” #30303
• OCPBUGS-62140: OCPSTRAT-2045:Automating OCPSTRAT-2045 feature in upstream #30299
• OCPBUGS-61757: test/extended/cli/adm_upgrade/recommend: Enable precheck and accept #30260
• OCPBUGS-62075: Temporarily remove commatrix documentation test for rework #30287
• OCPBUGS-62007: oidc: improve rollout wait times #30284
• CNF-18661: Update vendor with communication matrix bug fixes on 4.20 #30271
• OCPBUGS-61734: Restore retries for flaky port foward test #30266
• OCPBUGS-61540: chore(extended/prometheus): ²⁄₂: make ‘targets auth’ test more lenient and more resilient #30263
• OCPBUGS-61744: update machines scale test #30258
• OCPBUGS-61732: [release-4.20] CNTRLPLANE-945: oidc: add retry logic for Keycloak route creation #30251
• OCPBUGS-61731: [release-4.20] CNTRLPLANE-945: images: add keycloak images and use them in ExternalOIDC tests #30250
• OCPBUGS-61600: Skip config-operator checking when featureSet is DevPreviewNoUpgrade #30245
• OCPBUGS-61540: chore(extended/prometheus): make ‘targets auth’ test more lenient and more resilient. #30237
• OCPBUGS-61478: Add flaky kubectl logs test to the retry list to clean signal for release #30231
• OCPBUGS-61333: Bump to latest openshift/kubernetes (v1.33.4) #30228
• OCPBUGS-61286: Mark etcd net overload logging test as a flake #30214
• CNTRLPLANE-1306: Enable OTE for cluster-kube-storage-version-migrator-operator #30213
• CNTRLPLANE-945: [release-4.20] CNTRLPLANE-945: improve logging, add startup probe to Keycloak Deployment #30204
• Full changelog

vsphere-cluster-api-controllers

• OCPBUGS-78436: Updating ose-vsphere-cluster-api-controllers-container image to be consistent with ART for 4.20 #92
• OCPBUGS-61647: Fix unit tests #68
• Full changelog

vsphere-problem-detector

• OCPBUGS-74901: fix concurrent map writes #208
• OCPBUGS-65795: Fixed logic for vSphere compute cluster permission #197
• Full changelog

---

Node Image Info

Loading node image info, this may take a while ...

Red Hat Enterprise Linux CoreOS (rhel-coreos)

Package List

• cri-o-1.33.10-2.rhaos4.20.gita4d0894.el9
• kernel-5.14.0-570.107.1.el9_6
• openshift-kubelet-4.20.0-202604040156.p2.g51bc740.assembly.stream.el9
• systemd-252-51.el9_6.4

Full list (568 packages)

• NetworkManager-1:1.52.0-9.el9_6
• NetworkManager-cloud-setup-1:1.52.0-9.el9_6
• NetworkManager-libnm-1:1.52.0-9.el9_6
• NetworkManager-ovs-1:1.52.0-9.el9_6
• NetworkManager-team-1:1.52.0-9.el9_6
• NetworkManager-tui-1:1.52.0-9.el9_6
• WALinuxAgent-udev-2.13.1.1-1.el9_6
• aardvark-dns-2:1.14.0-1.el9
• acl-2.3.1-4.el9
• adcli-0.9.2-1.el9
• afterburn-5.9.0-1.el9_6
• afterburn-dracut-5.9.0-1.el9_6
• alternatives-1.24-2.el9
• attr-2.5.1-3.el9
• audit-3.1.5-4.el9
• audit-libs-3.1.5-4.el9
• authselect-1.2.6-3.el9
• authselect-libs-1.2.6-3.el9
• avahi-libs-0.8-22.el9_6.1
• basesystem-11-13.el9
• bash-5.1.8-9.el9
• bash-completion-1:2.11-5.el9
• bind-libs-32:9.16.23-31.el9_6.2
• bind-license-32:9.16.23-31.el9_6.2
• bind-utils-32:9.16.23-31.el9_6.2
• binutils-2.35.2-63.el9_6.1
• binutils-gold-2.35.2-63.el9_6.1
• bootc-1.1.6-4.el9_6
• bootupd-0.2.27-5.el9_6
• bsdtar-3.5.3-6.el9_6.1
• bubblewrap-0.4.1-8.el9_5
• bzip2-1.0.8-10.el9_5
• bzip2-libs-1.0.8-10.el9_5
• c-ares-1.19.1-2.el9_4
• ca-certificates-2025.2.80_v9.0.305-91.el9
• checkpolicy-3.6-1.el9
• chrony-4.6.1-1.el9
• cifs-utils-7.2-0.el9_6.2
• clevis-21-208.el9
• clevis-dracut-21-208.el9
• clevis-luks-21-208.el9
• clevis-systemd-21-208.el9
• cloud-utils-growpart-0.33-1.el9
• composefs-1.0.8-1.el9
• composefs-libs-1.0.8-1.el9
• conmon-3:2.1.12-1.el9
• conmon-rs-0.6.6-0.rhaos4.18.el9.1
• console-login-helper-messages-0.21.3-1.el9
• console-login-helper-messages-issuegen-0.21.3-1.el9
• console-login-helper-messages-profile-0.21.3-1.el9
• container-selinux-4:2.237.0-5.el9_6
• containernetworking-plugins-1:1.6.2-2.el9_6
• containers-common-2:1-117.el9_6
• coreos-installer-0.24.0-6.el9_6
• coreos-installer-bootinfra-0.24.0-6.el9_6
• coreutils-8.32-39.el9
• coreutils-common-8.32-39.el9
• cpio-2.13-16.el9
• cracklib-2.9.6-27.el9
• cracklib-dicts-2.9.6-27.el9
• cri-o-1.33.10-2.rhaos4.20.gita4d0894.el9
• cri-tools-1.33.0-3.el9
• criu-3.19-1.2.el9_6
• criu-libs-3.19-1.2.el9_6
• crun-1.26-1.el9_6
• crypto-policies-20250128-1.git5269e22.el9
• crypto-policies-scripts-20250128-1.git5269e22.el9
• cryptsetup-2.7.2-3.el9_6.1
• cryptsetup-libs-2.7.2-3.el9_6.1
• curl-7.76.1-31.el9_6.3
• cyrus-sasl-gssapi-2.1.27-21.el9
• cyrus-sasl-lib-2.1.27-21.el9
• dbus-1:1.12.20-8.el9
• dbus-broker-28-7.el9
• dbus-common-1:1.12.20-8.el9
• dbus-libs-1:1.12.20-8.el9
• dbus-tools-1:1.12.20-8.el9
• device-mapper-9:1.02.202-6.el9
• device-mapper-event-9:1.02.202-6.el9
• device-mapper-event-libs-9:1.02.202-6.el9
• device-mapper-libs-9:1.02.202-6.el9
• device-mapper-multipath-0.8.7-35.el9_6.3
• device-mapper-multipath-libs-0.8.7-35.el9_6.3
• device-mapper-persistent-data-1.1.0-1.el9
• diffutils-3.7-12.el9
• dmidecode-1:3.6-1.el9
• dnf-4.14.0-25.el9
• dnf-data-4.14.0-25.el9
• dnsmasq-2.85-17.el9_6
• dosfstools-4.2-3.el9
• dracut-057-89.git20250311.el9_6
• dracut-network-057-89.git20250311.el9_6
• dracut-squash-057-89.git20250311.el9_6
• e2fsprogs-1.46.5-7.el9
• e2fsprogs-libs-1.46.5-7.el9
• efi-filesystem-6-2.el9_0
• efibootmgr-16-12.el9
• efivar-libs-38-3.el9
• elfutils-debuginfod-client-0.192-6.el9_6
• elfutils-default-yama-scope-0.192-6.el9_6
• elfutils-libelf-0.192-6.el9_6
• elfutils-libs-0.192-6.el9_6
• ethtool-2:6.11-1.el9
• expat-2.5.0-5.el9_6.1
• fcoe-utils-1.0.34-0.git14ef0d2.el9
• file-5.39-16.el9
• file-libs-5.39-16.el9
• filesystem-3.16-5.el9
• findutils-1:4.8.0-7.el9
• firewalld-filesystem-1.3.4-15.el9_6
• flashrom-1.2-10.el9
• fstrm-0.6.1-3.el9
• fuse-2.9.9-17.el9
• fuse-common-3.10.2-9.el9
• fuse-libs-2.9.9-17.el9
• fuse-overlayfs-1.14-1.el9
• fuse3-3.10.2-9.el9
• fuse3-libs-3.10.2-9.el9
• fwupd-1.9.26-1.el9
• fwupd-plugin-flashrom-1.9.26-1.el9
• gawk-5.1.0-6.el9
• gawk-all-langpacks-5.1.0-6.el9
• gdbm-libs-1:1.23-1.el9
• gdisk-1.0.7-5.el9
• geolite2-city-20191217-6.el9
• geolite2-country-20191217-6.el9
• gettext-0.21-8.el9
• gettext-libs-0.21-8.el9
• git-core-2.47.3-1.el9_6
• glib2-2.68.4-16.el9_6.4
• glibc-2.34-168.el9_6.24
• glibc-common-2.34-168.el9_6.24
• glibc-gconv-extra-2.34-168.el9_6.24
• glibc-minimal-langpack-2.34-168.el9_6.24
• glusterfs-6.0-57.4.el9
• glusterfs-client-xlators-6.0-57.4.el9
• glusterfs-fuse-6.0-57.4.el9
• glusterfs-libs-6.0-57.4.el9
• gmp-1:6.2.0-13.el9
• gnupg2-2.3.3-4.el9_6.1
• gnutls-3.8.3-6.el9_6.3
• gobject-introspection-1.68.0-11.el9
• gpgme-1.15.1-6.el9
• grep-3.6-5.el9
• groff-base-1.22.4-10.el9
• grub2-common-1:2.06-105.el9_6.1
• grub2-efi-x64-1:2.06-105.el9_6.1
• grub2-pc-1:2.06-105.el9_6.1
• grub2-pc-modules-1:2.06-105.el9_6.1
• grub2-tools-1:2.06-105.el9_6.1
• grub2-tools-minimal-1:2.06-105.el9_6.1
• gssproxy-0.8.4-7.el9
• gzip-1.12-1.el9
• hostname-3.23-6.el9
• hwdata-0.348-9.18.el9
• ignition-2.21.0-6.el9_6
• ignition-grub-2.21.0-6.el9_6
• ima-evm-utils-1.5-3.el9
• info-6.7-15.el9
• inih-49-6.el9
• initscripts-service-10.11.8-4.el9
• ipcalc-1.0.0-5.el9
• iproute-6.11.0-1.el9
• iproute-tc-6.11.0-1.el9
• iptables-libs-1.8.10-11.el9_5
• iptables-nft-1.8.10-11.el9_5
• iputils-20210202-11.el9_6.3
• irqbalance-2:1.9.4-2.el9_6.2
• iscsi-initiator-utils-6.2.1.9-1.gita65a472.el9
• iscsi-initiator-utils-iscsiuio-6.2.1.9-1.gita65a472.el9
• isns-utils-libs-0.101-4.el9
• jansson-2.14-1.el9
• jose-14-1.el9
• jq-1.6-17.el9_6.2
• json-c-0.14-11.el9
• json-glib-1.6.6-1.el9
• kbd-2.4.0-11.el9
• kbd-legacy-2.4.0-11.el9
• kbd-misc-2.4.0-11.el9
• kernel-5.14.0-570.107.1.el9_6
• kernel-core-5.14.0-570.107.1.el9_6
• kernel-modules-5.14.0-570.107.1.el9_6
• kernel-modules-core-5.14.0-570.107.1.el9_6
• kernel-modules-extra-5.14.0-570.107.1.el9_6
• kexec-tools-2.0.29-5.el9_6.2
• keyutils-1.6.3-1.el9
• keyutils-libs-1.6.3-1.el9
• kmod-28-10.el9
• kmod-libs-28-10.el9
• kpartx-0.8.7-35.el9_6.3
• krb5-libs-1.21.1-8.el9_6.1
• less-590-5.el9
• libacl-2.3.1-4.el9
• libaio-0.3.111-13.el9
• libarchive-3.5.3-6.el9_6.1
• libassuan-2.5.5-3.el9
• libattr-2.5.1-3.el9
• libbasicobjects-0.1.1-53.el9
• libblkid-2.37.4-21.el9
• libbpf-2:1.5.0-1.el9
• libbrotli-1.0.9-7.el9_6.1
• libcap-2.48-9.el9_2
• libcap-ng-0.8.2-7.el9
• libcbor-0.7.0-5.el9
• libcollection-0.7.0-53.el9
• libcom_err-1.46.5-7.el9
• libcomps-0.1.18-1.el9
• libconfig-1.7.2-9.el9
• libcurl-7.76.1-31.el9_6.3
• libdaemon-0.14-23.el9
• libdb-5.3.28-57.el9_6
• libdhash-0.5.0-53.el9
• libdnf-0.69.0-13.el9
• libdnf-plugin-subscription-manager-1.29.45.1-1.el9_6
• libdrm-2.4.123-2.el9
• libeconf-0.4.1-4.el9
• libedit-3.1-38.20210216cvs.el9
• libev-4.33-6.el9
• libevent-2.1.12-8.el9_4
• libfdisk-2.37.4-21.el9
• libffi-3.4.2-8.el9
• libfido2-1.13.0-2.el9
• libgcc-11.5.0-5.el9_5
• libgcrypt-1.10.0-11.el9
• libgomp-11.5.0-5.el9_5
• libgpg-error-1.42-5.el9
• libgudev-237-1.el9
• libgusb-0.3.8-2.el9
• libibverbs-54.0-2.el9_6
• libicu-67.1-10.el9_6
• libidn2-2.3.0-7.el9
• libini_config-1.3.1-53.el9
• libipa_hbac-2.9.6-4.el9_6.3
• libjcat-0.1.6-3.el9
• libjose-14-1.el9
• libkcapi-1.4.0-2.el9
• libkcapi-hmaccalc-1.4.0-2.el9
• libksba-1.5.1-7.el9
• libldb-4.21.3-14.el9_6
• libluksmeta-9-12.el9
• libmaxminddb-1.5.2-4.el9
• libmicrohttpd-1:0.9.72-5.el9
• libmnl-1.0.4-16.el9_4
• libmodulemd-2.13.0-2.el9
• libmount-2.37.4-21.el9
• libmspack-0.10.1-0.7.alpha.el9
• libndp-1.9-1.el9
• libnet-1.2-7.el9
• libnetfilter_conntrack-1.0.9-1.el9
• libnfnetlink-1.0.1-23.el9_5
• libnfsidmap-1:2.5.4-34.el9_6.3
• libnftnl-1.2.6-4.el9_4
• libnghttp2-1.43.0-6.el9
• libnl3-3.11.0-1.el9
• libnl3-cli-3.11.0-1.el9
• libnvme-1.11.1-1.el9
• libpath_utils-0.2.1-53.el9
• libpcap-14:1.10.0-4.el9
• libpciaccess-0.16-7.el9
• libpkgconf-1.7.3-10.el9
• libpsl-0.21.1-5.el9
• libpwquality-1.4.4-8.el9
• libref_array-0.1.5-53.el9
• librepo-1.14.5-2.el9
• libreport-filesystem-2.15.2-6.el9
• librhsm-0.0.3-9.el9
• libseccomp-2.5.2-2.el9
• libselinux-3.6-3.el9
• libselinux-utils-3.6-3.el9
• libsemanage-3.6-5.el9_6
• libsepol-3.6-2.el9
• libsigsegv-2.13-4.el9
• libslirp-4.4.0-8.el9
• libsmartcols-2.37.4-21.el9
• libsmbclient-4.21.3-14.el9_6
• libsolv-0.7.24-3.el9
• libss-1.46.5-7.el9
• libssh-0.10.4-15.el9_6.1
• libssh-config-0.10.4-15.el9_6.1
• libsss_certmap-2.9.6-4.el9_6.3
• libsss_idmap-2.9.6-4.el9_6.3
• libsss_nss_idmap-2.9.6-4.el9_6.3
• libsss_sudo-2.9.6-4.el9_6.3
• libstdc++-11.5.0-5.el9_5
• libtalloc-2.4.2-1.el9
• libtasn1-4.16.0-9.el9
• libtdb-1.4.12-1.el9
• libteam-1.31-16.el9_1
• libtevent-0.16.1-1.el9
• libtirpc-1.3.3-9.el9
• libtool-ltdl-2.4.6-46.el9
• libunistring-0.9.10-15.el9
• liburing-2.5-1.el9
• libusbx-1.0.26-1.el9
• libuser-0.63-16.el9
• libutempter-1.2.1-6.el9
• libuuid-2.37.4-21.el9
• libuv-1:1.42.0-2.el9_4
• libverto-0.3.2-3.el9
• libverto-libev-0.3.2-3.el9
• libwbclient-4.21.3-14.el9_6
• libxcrypt-4.4.18-3.el9
• libxcrypt-compat-4.4.18-3.el9
• libxml2-2.9.13-12.el9_6.1
• libxmlb-0.3.10-1.el9
• libxslt-1.1.34-13.el9_6.1
• libyaml-0.2.5-7.el9
• libzstd-1.5.5-1.el9
• linux-firmware-20251111-151.8.el9_6
• linux-firmware-whence-20251111-151.8.el9_6
• lldpad-1.1.1-4.gitf1dd9eb.el9
• lmdb-libs-0.9.29-3.el9
• logrotate-3.18.0-9.el9
• lsof-4.94.0-3.el9
• lua-libs-5.4.4-4.el9
• luksmeta-9-12.el9
• lvm2-9:2.03.28-6.el9
• lvm2-libs-9:2.03.28-6.el9
• lz4-libs-1.9.3-5.el9
• lzo-2.10-7.el9
• mdadm-4.3-8.el9_6
• microcode_ctl-4:20250211-1.20260227.1.el9_6
• mokutil-2:0.6.0-4.el9
• mpfr-4.1.0-7.el9
• nano-5.6.1-7.el9
• ncurses-6.2-10.20210508.el9_6.2
• ncurses-base-6.2-10.20210508.el9_6.2
• ncurses-libs-6.2-10.20210508.el9_6.2
• net-tools-2.0-0.64.20160912git.el9
• netavark-2:1.14.1-1.el9_6
• nettle-3.10.1-1.el9
• newt-0.52.21-11.el9
• nfs-utils-1:2.5.4-34.el9_6.3
• nftables-1:1.0.9-4.el9_6
• nmap-ncat-3:7.92-3.el9
• nmstate-2.2.57-1.el9_6
• npth-1.6-8.el9
• nss-altfiles-2.18.1-20.el9
• numactl-libs-2.0.19-1.el9
• numad-0.5-37.20150602git.el9
• nvme-cli-2.11-7.el9_6
• oniguruma-6.9.6-1.el9.6
• open-vm-tools-12.5.0-1.el9_6.2
• openldap-2.6.8-4.el9
• openshift-clients-4.20.0-202603030647.p2.g64e778a.assembly.stream.el9
• openshift-kubelet-4.20.0-202604040156.p2.g51bc740.assembly.stream.el9
• openssh-8.7p1-45.el9_6.1
• openssh-clients-8.7p1-45.el9_6.1
• openssh-server-8.7p1-45.el9_6.1
• openssl-1:3.2.2-7.el9_6.2
• openssl-fips-provider-3.0.7-6.el9_5
• openssl-fips-provider-so-3.0.7-6.el9_5
• openssl-libs-1:3.2.2-7.el9_6.2
• openvswitch-selinux-extra-policy-1.0-39.el9fdp
• openvswitch3.5-3.5.2-72.el9fdp
• os-prober-1.77-12.el9_5
• ose-aws-ecr-image-credential-provider-4.20.0-202602241728.p2.gbb88da1.assembly.stream.el9
• ose-azure-acr-image-credential-provider-4.20.0-202602241728.p2.gd469d04.assembly.stream.el9
• ose-gcp-gcr-image-credential-provider-4.20.0-202602261434.p2.ge3014e7.assembly.stream.el9
• ostree-2025.2-4.el9_6
• ostree-grub2-2025.2-4.el9_6
• ostree-libs-2025.2-4.el9_6
• p11-kit-0.25.3-3.el9_5
• p11-kit-trust-0.25.3-3.el9_5
• pam-1.5.1-26.el9_6
• passt-0^20250217.ga1e48a0-13.el9_6
• passt-selinux-0^20250217.ga1e48a0-13.el9_6
• passwd-0.80-12.el9
• pciutils-3.7.0-7.el9
• pciutils-libs-3.7.0-7.el9
• pcre-8.44-4.el9
• pcre2-10.40-6.el9
• pcre2-syntax-10.40-6.el9
• perl-AutoLoader-5.74-481.1.el9_6
• perl-B-1.80-481.1.el9_6
• perl-Carp-1.50-460.el9
• perl-Class-Struct-0.66-481.1.el9_6
• perl-Data-Dumper-2.174-462.el9
• perl-Digest-1.19-4.el9
• perl-Digest-MD5-2.58-4.el9
• perl-Encode-4:3.08-462.el9
• perl-Errno-1.30-481.1.el9_6
• perl-Exporter-5.74-461.el9
• perl-Fcntl-1.13-481.1.el9_6
• perl-File-Basename-2.85-481.1.el9_6
• perl-File-Path-2.18-4.el9
• perl-File-Temp-1:0.231.100-4.el9
• perl-File-stat-1.09-481.1.el9_6
• perl-FileHandle-2.03-481.1.el9_6
• perl-Getopt-Long-1:2.52-4.el9
• perl-Getopt-Std-1.12-481.1.el9_6
• perl-HTTP-Tiny-0.076-462.el9
• perl-IO-1.43-481.1.el9_6
• perl-IO-Socket-IP-0.41-5.el9
• perl-IO-Socket-SSL-2.073-2.el9
• perl-IPC-Open3-1.21-481.1.el9_6
• perl-MIME-Base64-3.16-4.el9
• perl-Mozilla-CA-20200520-6.el9
• perl-NDBM_File-1.15-481.1.el9_6
• perl-Net-SSLeay-1.94-1.el9
• perl-POSIX-1.94-481.1.el9_6
• perl-PathTools-3.78-461.el9
• perl-Pod-Escapes-1:1.07-460.el9
• perl-Pod-Perldoc-3.28.01-461.el9
• perl-Pod-Simple-1:3.42-4.el9
• perl-Pod-Usage-4:2.01-4.el9
• perl-Scalar-List-Utils-4:1.56-462.el9
• perl-SelectSaver-1.02-481.1.el9_6
• perl-Socket-4:2.031-4.el9
• perl-Storable-1:3.21-460.el9
• perl-Symbol-1.08-481.1.el9_6
• perl-Term-ANSIColor-5.01-461.el9
• perl-Term-Cap-1.17-460.el9
• perl-Text-ParseWords-3.30-460.el9
• perl-Text-Tabs+Wrap-2013.0523-460.el9
• perl-Time-Local-2:1.300-7.el9
• perl-URI-5.09-3.el9
• perl-base-2.27-481.1.el9_6
• perl-constant-1.33-461.el9
• perl-if-0.60.800-481.1.el9_6
• perl-interpreter-4:5.32.1-481.1.el9_6
• perl-libnet-3.13-4.el9
• perl-libs-4:5.32.1-481.1.el9_6
• perl-mro-1.23-481.1.el9_6
• perl-overload-1.31-481.1.el9_6
• perl-overloading-0.02-481.1.el9_6
• perl-parent-1:0.238-460.el9
• perl-podlators-1:4.14-460.el9
• perl-subs-1.03-481.1.el9_6
• perl-vars-1.05-481.1.el9_6
• pigz-2.8-1.el9
• pkgconf-1.7.3-10.el9
• pkgconf-m4-1.7.3-10.el9
• pkgconf-pkg-config-1.7.3-10.el9
• podman-5:5.4.0-20.el9_6.2
• policycoreutils-3.6-2.1.el9
• policycoreutils-python-utils-3.6-2.1.el9
• polkit-0.117-13.el9
• polkit-libs-0.117-13.el9
• polkit-pkla-compat-0.1-21.el9
• popt-1.18-8.el9
• procps-ng-3.3.17-14.el9
• protobuf-c-1.3.3-13.el9
• psmisc-23.4-3.el9
• publicsuffix-list-dafsa-20210518-3.el9
• python-unversioned-command-3.9.21-2.el9_6.4
• python3-3.9.21-2.el9_6.4
• python3-audit-3.1.5-4.el9
• python3-chardet-4.0.0-5.el9
• python3-cloud-what-1.29.45.1-1.el9_6
• python3-dateutil-1:2.8.1-7.el9
• python3-dbus-1.2.18-2.el9
• python3-decorator-4.4.2-6.el9
• python3-distro-1.5.0-7.el9
• python3-dnf-4.14.0-25.el9
• python3-dnf-plugin-versionlock-4.3.0-20.el9
• python3-dnf-plugins-core-4.3.0-20.el9
• python3-gobject-base-3.40.1-6.el9
• python3-gobject-base-noarch-3.40.1-6.el9
• python3-gpg-1.15.1-6.el9
• python3-hawkey-0.69.0-13.el9
• python3-idna-2.10-7.el9_4.1
• python3-iniparse-0.4-45.el9
• python3-inotify-0.9.6-25.el9
• python3-libcomps-0.1.18-1.el9
• python3-libdnf-0.69.0-13.el9
• python3-librepo-1.14.5-2.el9
• python3-libs-3.9.21-2.el9_6.4
• python3-libselinux-3.6-3.el9
• python3-libsemanage-3.6-5.el9_6
• python3-pip-wheel-21.3.1-1.el9
• python3-policycoreutils-3.6-2.1.el9
• python3-pysocks-1.7.1-12.el9
• python3-pyyaml-5.4.1-6.el9
• python3-requests-2.25.1-10.el9_6
• python3-rpm-4.16.1.3-37.el9
• python3-setools-4.4.4-1.el9
• python3-setuptools-53.0.0-13.el9_6.1
• python3-setuptools-wheel-53.0.0-13.el9_6.1
• python3-six-1.15.0-9.el9
• python3-subscription-manager-rhsm-1.29.45.1-1.el9_6
• python3-systemd-234-19.el9
• python3-urllib3-1.26.5-6.el9_6.1
• qemu-guest-agent-17:9.1.0-15.el9_6.18
• quota-1:4.09-4.el9
• quota-nls-1:4.09-4.el9
• rdma-core-54.0-2.el9_6
• readline-8.1-4.el9
• redhat-release-9.6-0.1.el9
• redhat-release-eula-9.6-0.1.el9
• rpcbind-1.2.6-7.el9
• rpm-4.16.1.3-37.el9
• rpm-build-libs-4.16.1.3-37.el9
• rpm-libs-4.16.1.3-37.el9
• rpm-ostree-2025.6-6.el9_6
• rpm-ostree-libs-2025.6-6.el9_6
• rpm-plugin-selinux-4.16.1.3-37.el9
• rpm-plugin-systemd-inhibit-4.16.1.3-37.el9
• rpm-sign-libs-4.16.1.3-37.el9
• rsync-3.2.5-3.el9
• runc-4:1.2.9-2.el9_6
• samba-client-libs-4.21.3-14.el9_6
• samba-common-4.21.3-14.el9_6
• samba-common-libs-4.21.3-14.el9_6
• sed-4.8-9.el9
• selinux-policy-38.1.53-5.el9_6.1
• selinux-policy-targeted-38.1.53-5.el9_6.1
• setup-2.13.7-10.el9
• sg3_utils-1.47-10.el9
• sg3_utils-libs-1.47-10.el9
• shadow-utils-2:4.9-12.el9
• shadow-utils-subid-2:4.9-12.el9
• shared-mime-info-2.1-5.el9
• shim-x64-15.8-4.el9_3
• skopeo-2:1.18.1-3.el9_6
• slang-2.3.2-11.el9
• slirp4netns-1.3.2-1.el9
• snappy-1.1.8-8.el9
• socat-1.7.4.1-6.el9_6.1
• sqlite-libs-3.34.1-8.el9_6
• squashfs-tools-4.4-10.git1.el9
• ssh-key-dir-0.1.4-1.el9
• sssd-2.9.6-4.el9_6.3
• sssd-ad-2.9.6-4.el9_6.3
• sssd-client-2.9.6-4.el9_6.3
• sssd-common-2.9.6-4.el9_6.3
• sssd-common-pac-2.9.6-4.el9_6.3
• sssd-ipa-2.9.6-4.el9_6.3
• sssd-krb5-2.9.6-4.el9_6.3
• sssd-krb5-common-2.9.6-4.el9_6.3
• sssd-ldap-2.9.6-4.el9_6.3
• sssd-nfs-idmap-2.9.6-4.el9_6.3
• sssd-proxy-2.9.6-4.el9_6.3
• stalld-1.20.4-1.el9_6
• strace-6.12-1.el9
• subscription-manager-1.29.45.1-1.el9_6
• subscription-manager-rhsm-certificates-20220623-1.el9
• sudo-1.9.5p2-10.el9_6.2
• systemd-252-51.el9_6.4
• systemd-journal-remote-252-51.el9_6.4
• systemd-libs-252-51.el9_6.4
• systemd-pam-252-51.el9_6.4
• systemd-rpm-macros-252-51.el9_6.4
• systemd-udev-252-51.el9_6.4
• tar-2:1.34-7.el9_6.2
• teamd-1.31-16.el9_1
• tmux-3.2a-5.el9
• toolbox-0.1.2-1.rhaos4.19.el9
• tpm2-tools-5.2-4.el9
• tpm2-tss-3.2.3-1.el9
• tzdata-2026a-1.el9_0
• unbound-libs-1.16.2-19.el9_6.1
• usermode-1.114-6.el9
• userspace-rcu-0.12.1-6.el9
• util-linux-2.37.4-21.el9
• util-linux-core-2.37.4-21.el9
• vim-minimal-2:8.2.2637-22.el9_6.2
• virt-what-1.27-1.el9
• which-2.21-30.el9_6
• xfsprogs-6.4.0-5.el9
• xmlsec1-1.2.29-13.el9
• xmlsec1-openssl-1.2.29-13.el9
• xz-5.2.5-8.el9_0
• xz-libs-5.2.5-8.el9_0
• yajl-2.1.0-25.el9
• zlib-1.2.11-40.el9
• zram-generator-0.3.2-7.el9
• zstd-1.5.5-1.el9

Changed:

• bsdtar 3.5.3-6.el9_6 → 3.5.3-6.el9_6.1
• cri-o 1.34.6-2.rhaos4.21.gitbca534a.el9 → 1.33.10-2.rhaos4.20.gita4d0894.el9
• cri-tools 1.34.0-4.el9 → 1.33.0-3.el9
• kernel 5.14.0-570.106.1.el9_6 → 5.14.0-570.107.1.el9_6
• kernel-core 5.14.0-570.106.1.el9_6 → 5.14.0-570.107.1.el9_6
• kernel-modules 5.14.0-570.106.1.el9_6 → 5.14.0-570.107.1.el9_6
• kernel-modules-core 5.14.0-570.106.1.el9_6 → 5.14.0-570.107.1.el9_6
• kernel-modules-extra 5.14.0-570.106.1.el9_6 → 5.14.0-570.107.1.el9_6
• krb5-libs 1.21.1-8.el9_6 → 1.21.1-8.el9_6.1
• libarchive 3.5.3-6.el9_6 → 3.5.3-6.el9_6.1
• openshift-clients 4.21.0-202603290052.p2.g9d9df34.assembly.stream.el9 → 4.20.0-202603030647.p2.g64e778a.assembly.stream.el9
• openshift-kubelet 4.21.0-202604030310.p2.gdfffacd.assembly.stream.el9 → 4.20.0-202604040156.p2.g51bc740.assembly.stream.el9
• ose-aws-ecr-image-credential-provider 4.21.0-202603171946.p2.gfdc7f3f.assembly.stream.el9 → 4.20.0-202602241728.p2.gbb88da1.assembly.stream.el9
• ose-azure-acr-image-credential-provider 4.21.0-202603171055.p2.g83b3f9e.assembly.stream.el9 → 4.20.0-202602241728.p2.gd469d04.assembly.stream.el9
• ose-gcp-gcr-image-credential-provider 4.21.0-202603171055.p2.g8732386.assembly.stream.el9 → 4.20.0-202602261434.p2.ge3014e7.assembly.stream.el9
• podman 5:5.4.0-18.el9_6 → 5:5.4.0-20.el9_6.2

Removed:

• ose-crio-credential-provider 4.21.0-202603171055.p2.g83d4961.assembly.stream.el9

Added:

• fcoe-utils 1.0.34-0.git14ef0d2.el9
• libconfig 1.7.2-9.el9
• lldpad 1.1.1-4.gitf1dd9eb.el9

Extensions

Full list (162 packages)

• NetworkManager-libreswan-1.2.29-1.el9_6.x86_64
• bison-3.7.4-5.el9.x86_64
• capstone-4.0.2-11.el9_6.x86_64
• corosync-3.1.9-2.el9_6.x86_64
• corosynclib-3.1.9-2.el9_6.x86_64
• cpp-11.5.0-5.el9_5.x86_64
• crun-wasm-1.8.5-5.rhaos4.14.el9.x86_64
• daxctl-libs-78-2.el9.x86_64
• edk2-ovmf-20241117-2.el9_6.2.noarch
• elfutils-libelf-devel-0.192-6.el9_6.x86_64
• fence-agents-all-4.10.0-86.el9_6.15.x86_64
• fence-agents-amt-ws-4.10.0-86.el9_6.15.noarch
• fence-agents-apc-4.10.0-86.el9_6.15.noarch
• fence-agents-apc-snmp-4.10.0-86.el9_6.15.noarch
• fence-agents-bladecenter-4.10.0-86.el9_6.15.noarch
• fence-agents-brocade-4.10.0-86.el9_6.15.noarch
• fence-agents-cisco-mds-4.10.0-86.el9_6.15.noarch
• fence-agents-cisco-ucs-4.10.0-86.el9_6.15.noarch
• fence-agents-common-4.10.0-86.el9_6.15.noarch
• fence-agents-drac5-4.10.0-86.el9_6.15.noarch
• fence-agents-eaton-snmp-4.10.0-86.el9_6.15.noarch
• fence-agents-emerson-4.10.0-86.el9_6.15.noarch
• fence-agents-eps-4.10.0-86.el9_6.15.noarch
• fence-agents-heuristics-ping-4.10.0-86.el9_6.15.noarch
• fence-agents-hpblade-4.10.0-86.el9_6.15.noarch
• fence-agents-ibmblade-4.10.0-86.el9_6.15.noarch
• fence-agents-ifmib-4.10.0-86.el9_6.15.noarch
• fence-agents-ilo-moonshot-4.10.0-86.el9_6.15.noarch
• fence-agents-ilo-mp-4.10.0-86.el9_6.15.noarch
• fence-agents-ilo-ssh-4.10.0-86.el9_6.15.noarch
• fence-agents-ilo2-4.10.0-86.el9_6.15.noarch
• fence-agents-intelmodular-4.10.0-86.el9_6.15.noarch
• fence-agents-ipdu-4.10.0-86.el9_6.15.noarch
• fence-agents-ipmilan-4.10.0-86.el9_6.15.noarch
• fence-agents-kdump-4.10.0-86.el9_6.15.x86_64
• fence-agents-mpath-4.10.0-86.el9_6.15.noarch
• fence-agents-redfish-4.10.0-86.el9_6.15.x86_64
• fence-agents-rhevm-4.10.0-86.el9_6.15.noarch
• fence-agents-rsa-4.10.0-86.el9_6.15.noarch
• fence-agents-rsb-4.10.0-86.el9_6.15.noarch
• fence-agents-sbd-4.10.0-86.el9_6.15.noarch
• fence-agents-scsi-4.10.0-86.el9_6.15.noarch
• fence-agents-vmware-rest-4.10.0-86.el9_6.15.noarch
• fence-agents-vmware-soap-4.10.0-86.el9_6.15.noarch
• fence-agents-wti-4.10.0-86.el9_6.15.noarch
• fence-virt-4.10.0-86.el9_6.15.x86_64
• flex-2.6.4-9.el9.x86_64
• fmt-9.1.0-1.el9.x86_64
• gcc-11.5.0-5.el9_5.x86_64
• glibc-devel-2.34-168.el9_6.24.x86_64
• glibc-headers-2.34-168.el9_6.24.x86_64
• gnutls-dane-3.8.3-6.el9_6.3.x86_64
• gnutls-utils-3.8.3-6.el9_6.3.x86_64
• ipmitool-1.8.18-27.el9.x86_64
• ipxe-roms-qemu-20200823-9.git4bd064de.el9_0.noarch
• kata-containers-3.25.0-5.rhaos4.20.el9.x86_64
• kernel-5.14.0-570.107.1.el9_6.x86_64
• kernel-core-5.14.0-570.107.1.el9_6.x86_64
• kernel-devel-5.14.0-570.107.1.el9_6.x86_64
• kernel-headers-5.14.0-570.107.1.el9_6.x86_64
• kernel-modules-5.14.0-570.107.1.el9_6.x86_64
• kernel-modules-extra-5.14.0-570.107.1.el9_6.x86_64
• kernel-rt-core-5.14.0-570.107.1.el9_6.x86_64
• kernel-rt-devel-5.14.0-570.107.1.el9_6.x86_64
• kernel-rt-kvm-5.14.0-570.107.1.el9_6.x86_64
• kernel-rt-modules-5.14.0-570.107.1.el9_6.x86_64
• kernel-rt-modules-core-5.14.0-570.107.1.el9_6.x86_64
• kernel-rt-modules-extra-5.14.0-570.107.1.el9_6.x86_64
• krb5-pkinit-1.21.1-8.el9_6.1.x86_64
• krb5-workstation-1.21.1-8.el9_6.1.x86_64
• ldns-1.7.1-12.el9.x86_64
• libfdt-1.6.0-7.el9.x86_64
• libkadm5-1.21.1-8.el9_6.1.x86_64
• libknet1-1.28-1.el9.x86_64
• libknet1-compress-bzip2-plugin-1.28-1.el9.x86_64
• libknet1-compress-lz4-plugin-1.28-1.el9.x86_64
• libknet1-compress-lzma-plugin-1.28-1.el9.x86_64
• libknet1-compress-lzo2-plugin-1.28-1.el9.x86_64
• libknet1-compress-plugins-all-1.28-1.el9.x86_64
• libknet1-compress-zlib-plugin-1.28-1.el9.x86_64
• libknet1-compress-zstd-plugin-1.28-1.el9.x86_64
• libknet1-crypto-nss-plugin-1.28-1.el9.x86_64
• libknet1-crypto-openssl-plugin-1.28-1.el9.x86_64
• libknet1-crypto-plugins-all-1.28-1.el9.x86_64
• libknet1-plugins-all-1.28-1.el9.x86_64
• libmpc-1.2.1-4.el9.x86_64
• libnozzle1-1.28-1.el9.x86_64
• libpmem-1.12.1-1.el9.x86_64
• libpng-2:1.6.37-12.el9_6.2.x86_64
• libqb-2.0.8-1.el9.x86_64
• librdmacm-54.0-2.el9_6.x86_64
• libreswan-5.3-5.el9fdp.x86_64
• libwsman1-2.6.8-23.el9.x86_64
• libxcrypt-devel-4.4.18-3.el9.x86_64
• libzstd-devel-1.5.5-1.el9.x86_64
• lld-17.0.6-1.el9.x86_64
• lld-libs-17.0.6-1.el9.x86_64
• llvm-17.0.6-5.el9.x86_64
• llvm-libs-17.0.6-5.el9.x86_64
• lm_sensors-libs-3.6.0-10.el9.x86_64
• m4-1.4.19-1.el9.x86_64
• make-1:4.3-8.el9.x86_64
• ndctl-libs-78-2.el9.x86_64
• net-snmp-libs-1:5.9.1-17.el9_6.1.x86_64
• net-snmp-utils-1:5.9.1-17.el9_6.1.x86_64
• nspr-4.36.0-8.el9_4.x86_64
• nss-3.112.0-8.el9_4.x86_64
• nss-softokn-3.112.0-8.el9_4.x86_64
• nss-softokn-freebl-3.112.0-8.el9_4.x86_64
• nss-sysinit-3.112.0-8.el9_4.x86_64
• nss-tools-3.112.0-8.el9_4.x86_64
• nss-util-3.112.0-8.el9_4.x86_64
• openssl-devel-1:3.2.2-7.el9_6.2.x86_64
• openvswitch3.5-ipsec-3.5.2-72.el9fdp.x86_64
• openwsman-python3-2.6.8-23.el9.x86_64
• pacemaker-2.1.9-1.2.el9_6.x86_64
• pacemaker-cli-2.1.9-1.2.el9_6.x86_64
• pacemaker-cluster-libs-2.1.9-1.2.el9_6.x86_64
• pacemaker-libs-2.1.9-1.2.el9_6.x86_64
• pacemaker-schemas-2.1.9-1.2.el9_6.noarch
• pcp-conf-6.3.7-1.el9_6.x86_64
• pcp-libs-6.3.7-1.el9_6.x86_64
• pcs-0.11.9-2.el9_6.3.x86_64
• perl-TimeDate-1:2.33-6.el9.noarch
• pixman-0.40.0-6.el9_3.x86_64
• protobuf-3.14.0-16.el9_6.1.x86_64
• python3-cffi-1.14.5-5.el9.x86_64
• python3-cryptography-36.0.1-5.el9_6.x86_64
• python3-lxml-4.6.5-3.el9.x86_64
• python3-openvswitch3.5-3.5.2-72.el9fdp.x86_64
• python3-ply-3.11-14.el9.noarch
• python3-pycparser-2.20-6.el9.noarch
• python3-pycurl-7.43.0.6-8.el9.x86_64
• python3-pyparsing-2.4.7-9.el9.noarch
• python3-tornado-6.4.2-2.el9_6.2.x86_64
• qemu-img-17:9.1.0-15.el9_6.18.x86_64
• qemu-kvm-common-17:9.1.0-15.el9_6.18.x86_64
• qemu-kvm-core-17:9.1.0-15.el9_6.18.x86_64
• redhat-logos-90.5-1.el9_6.1.x86_64
• resource-agents-4.10.0-71.el9_6.21.x86_64
• ruby-3.0.7-165.el9_5.x86_64
• ruby-default-gems-3.0.7-165.el9_5.noarch
• ruby-libs-3.0.7-165.el9_5.x86_64
• rubygem-bigdecimal-3.0.0-165.el9_5.x86_64
• rubygem-bundler-2.2.33-165.el9_5.noarch
• rubygem-io-console-0.5.7-165.el9_5.x86_64
• rubygem-json-2.5.1-165.el9_5.x86_64
• rubygem-psych-3.3.2-165.el9_5.x86_64
• rubygem-rdoc-6.3.4.1-165.el9_5.noarch
• rubygem-rexml-3.2.5-165.el9_5.noarch
• rubygems-3.2.33-165.el9_5.noarch
• sbd-1.5.2-1.el9.x86_64
• seabios-bin-1.16.3-4.el9.noarch
• seavgabios-bin-1.16.3-4.el9.noarch
• spdlog-1.13.0-1.rhaos4.14.el9.x86_64
• sysstat-12.5.4-9.el9.x86_64
• telnet-1:0.17-85.el9.x86_64
• usbguard-1.0.0-16.el9.x86_64
• usbguard-selinux-1.0.0-16.el9.noarch
• virtiofsd-1.13.2-1.el9_6.x86_64
• wasmedge-0.14.0-2.rhaos4.20.el9.x86_64
• zlib-devel-1.2.11-40.el9.x86_64

Red Hat Enterprise Linux CoreOS base layer: 9.6.20260414-0