# 4.19.0-okd-scos.2

Created: 2025-06-02 19:22:06 +0000 UTC

Image Digest: `sha256:12fea3266bf3e34044d9e9e73c8ebd1019f1e0fd902617deca5be1fdd06db37f`

Promoted from registry.ci.openshift.org/origin/release-scos:4.19.0-0.okd-scos-2025-05-31-105934


## Changes from 4.19.0-okd-scos.1

### Components

* Kubectl 1.32.1
* Kubernetes upgraded from 1.32.4 to 1.32.5
* Kubernetes Tests upgraded from 1.32.4 to 1.32.5
* CentOS Stream CoreOS 9.0.20250515-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| OpenShiftPodSecurityAdmission <br/> (0 tests)| Disabled<br/>(Changed)| Disabled<br/>(Changed)| Enabled| Enabled| Enabled| Enabled |


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/0c4ca57fb2b169525ac58e7020883b1a9b70b023)

* [OCPBUGS-56810](https://issues.redhat.com/browse/OCPBUGS-56810): bump appliance to 936210 [#99](https://github.com/openshift/agent-installer-utils/pull/99)
* [OCPBUGS-56759](https://issues.redhat.com/browse/OCPBUGS-56759): ISOBuilder- Remove default password for nodes [#100](https://github.com/openshift/agent-installer-utils/pull/100)
* [OCPBUGS-56490](https://issues.redhat.com/browse/OCPBUGS-56490): Add operator CRs post-install in OVE build script [#95](https://github.com/openshift/agent-installer-utils/pull/95)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/766df82081a65c57df4a0a5d19cea6635a31314c...0c4ca57fb2b169525ac58e7020883b1a9b70b023)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/b61e357915000a5f6dc50aad2cabeb1ac55e2e3c)

* [OCPBUGS-56527](https://issues.redhat.com/browse/OCPBUGS-56527): openstack-cinder: Set --with-topology flag for node driver also [#384](https://github.com/openshift/csi-operator/pull/384)
* [Full changelog](https://github.com/openshift/csi-operator/compare/6bb12490780bbabc88b82bfe51197a961e4e722a...b61e357915000a5f6dc50aad2cabeb1ac55e2e3c)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/249e31eba655572a52f44c6065bc251341544883)

* [OCPBUGS-56653](https://issues.redhat.com/browse/OCPBUGS-56653): Fix failure when attempting to modify immutable availabilitySet [#154](https://github.com/openshift/machine-api-provider-azure/pull/154)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/dd3ca5704052ab83cc829e9be33b127d0d764a2a...249e31eba655572a52f44c6065bc251341544883)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/741cd11fa65540a4ec7ef046afdc1e77c1439c75)

* [OCPBUGS-56826](https://issues.redhat.com/browse/OCPBUGS-56826): update the punctuation [#9755](https://github.com/openshift/installer/pull/9755)
* [OCPBUGS-56372](https://issues.redhat.com/browse/OCPBUGS-56372): Added better logging for vSphere destroy [#9719](https://github.com/openshift/installer/pull/9719)
* [OCPBUGS-56832](https://issues.redhat.com/browse/OCPBUGS-56832): add unit tests for vsphere VIPS/machinenetworks population [#9757](https://github.com/openshift/installer/pull/9757)
* [OCPBUGS-56811](https://issues.redhat.com/browse/OCPBUGS-56811): Update Control Plane replica validation for Single Node OpenShift [#9756](https://github.com/openshift/installer/pull/9756)
* [MGMT-20702](https://issues.redhat.com/browse/MGMT-20702), [OCPBUGS-56762](https://issues.redhat.com/browse/OCPBUGS-56762): Avoid duplicate machine networks [#9745](https://github.com/openshift/installer/pull/9745)
* [OCPBUGS-55995](https://issues.redhat.com/browse/OCPBUGS-55995): [Nutanix] nil error displayed when setting a not exist value in preloadedOSImageName field [#9701](https://github.com/openshift/installer/pull/9701)
* [OCPBUGS-56712](https://issues.redhat.com/browse/OCPBUGS-56712): add the VM types that the install pass into the tested_instance_types [#9730](https://github.com/openshift/installer/pull/9730)
* [OCPBUGS-56646](https://issues.redhat.com/browse/OCPBUGS-56646): Update RHCOS 4.19 bootimage metadata to 9.6.20250523-0 [#9742](https://github.com/openshift/installer/pull/9742)
* [OCPBUGS-56595](https://issues.redhat.com/browse/OCPBUGS-56595): [release-4.19] OCPBUGS-56567: default Azure to create VM user-assigned identities [#9735](https://github.com/openshift/installer/pull/9735)
* [Full changelog](https://github.com/openshift/installer/compare/180d12f3c63388fb71150e8ce67dfb1e8e881c70...741cd11fa65540a4ec7ef046afdc1e77c1439c75)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/8f1c8b5768cdff8885ddef28e10de2c1928daf92)

* [OCPBUGS-56511](https://issues.redhat.com/browse/OCPBUGS-56511): Replace colon to hypen in the filename while extracting tar on Windows [#2024](https://github.com/openshift/oc/pull/2024)
* [Full changelog](https://github.com/openshift/oc/compare/c88fd60ed9c4a349d52770884b3aad828432d01d...8f1c8b5768cdff8885ddef28e10de2c1928daf92)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/20af0c3e9e089573e9528c0a4d41d5f26255c3f6)

* [OCPBUGS-55903](https://issues.redhat.com/browse/OCPBUGS-55903): Render: configure proxy on bootstrap static pod [#857](https://github.com/openshift/cloud-credential-operator/pull/857)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/409aa6893af94d8de67d07b03293676b5523412a...20af0c3e9e089573e9528c0a4d41d5f26255c3f6)


### [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator/tree/ee69183571b592073a7163c5aef34d1a970a8c19)

* [OCPBUGS-56776](https://issues.redhat.com/browse/OCPBUGS-56776): fix: ensure CAPI machineset is created not paused when authoritative [#304](https://github.com/openshift/cluster-capi-operator/pull/304)
* [OCPBUGS-56714](https://issues.redhat.com/browse/OCPBUGS-56714): fix: bump openshift/library-go to fix ValidatingAdmissionPolicyV1 apply in capiinstaller [#305](https://github.com/openshift/cluster-capi-operator/pull/305)
* [OCPBUGS-56633](https://issues.redhat.com/browse/OCPBUGS-56633): fix: watch CAPI resources in the migration controllers [#303](https://github.com/openshift/cluster-capi-operator/pull/303)
* [OCPBUGS-56722](https://issues.redhat.com/browse/OCPBUGS-56722): MachineSet deletion logic [#302](https://github.com/openshift/cluster-capi-operator/pull/302)
* [Full changelog](https://github.com/openshift/cluster-capi-operator/compare/321712b12b7a71240a49efa83e0bb5a1d6ada3d7...ee69183571b592073a7163c5aef34d1a970a8c19)


### [cluster-config-api](https://github.com/openshift/api/tree/97812373b6b447ff6b55d3e2625b4f62aff1a16f)

* [OCPBUGS-56773](https://issues.redhat.com/browse/OCPBUGS-56773): disable psa for 4.19 [#2346](https://github.com/openshift/api/pull/2346)
* [OCPBUGS-56761](https://issues.redhat.com/browse/OCPBUGS-56761): Revert v1alpha1 removal [#2345](https://github.com/openshift/api/pull/2345)
* [OCPBUGS-56407](https://issues.redhat.com/browse/OCPBUGS-56407): Fix validation for Resource field in MOSB API [#2329](https://github.com/openshift/api/pull/2329)
* [Full changelog](https://github.com/openshift/api/compare/d22fca85e3b9f77f0cf2b43759a5ff927e605f57...97812373b6b447ff6b55d3e2625b4f62aff1a16f)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/328419e7a2aba288a3405e76449f84d42b1952b3)

* [OCPBUGS-53872](https://issues.redhat.com/browse/OCPBUGS-53872): bump github.com/golang-jwt/jwt [#1214](https://github.com/openshift/cluster-image-registry-operator/pull/1214)
* [OCPBUGS-56363](https://issues.redhat.com/browse/OCPBUGS-56363): bump golang.org/x/oauth2 [#1207](https://github.com/openshift/cluster-image-registry-operator/pull/1207)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/85ac017f7c393b18696bf77a6e6415d05418dd0b...328419e7a2aba288a3405e76449f84d42b1952b3)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/06f6aa6e22eadcc38d57f5786c50ceef38bb4d5e)

* [OCPBUGS-56771](https://issues.redhat.com/browse/OCPBUGS-56771): Fix ImplicitlyEnabledCapabilities [#1199](https://github.com/openshift/cluster-version-operator/pull/1199)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/09edded491b9b591445a3502cb719403eb5f52e4...06f6aa6e22eadcc38d57f5786c50ceef38bb4d5e)


### [console](https://github.com/openshift/console/tree/94c7d7c00db644607ecd97459add850e5247a309)

* [OCPBUGS-56149](https://issues.redhat.com/browse/OCPBUGS-56149): Refactor Kebab+ActionsMenu to use PF [#15051](https://github.com/openshift/console/pull/15051)
* [OCPBUGS-56413](https://issues.redhat.com/browse/OCPBUGS-56413): [knative] Self-provisioner user can not access or create event sources via ODC [#15067](https://github.com/openshift/console/pull/15067)
* [OCPBUGS-55941](https://issues.redhat.com/browse/OCPBUGS-55941), [OCPBUGS-56107](https://issues.redhat.com/browse/OCPBUGS-56107): get `go mod tidy` to pass, bump Console Helm dependencies to 3.17.3 [#15032](https://github.com/openshift/console/pull/15032)
* [OCPBUGS-56362](https://issues.redhat.com/browse/OCPBUGS-56362): improve description of the custom logos CLI args [#15061](https://github.com/openshift/console/pull/15061)
* [OCPBUGS-55979](https://issues.redhat.com/browse/OCPBUGS-55979): fix alignment of Getting Started item icons [#15040](https://github.com/openshift/console/pull/15040)
* [OCPBUGS-55929](https://issues.redhat.com/browse/OCPBUGS-55929): Sample segment sessions [#15031](https://github.com/openshift/console/pull/15031)
* NO-JIRA: Update plugin SDK docs [#15074](https://github.com/openshift/console/pull/15074)
* [OCPBUGS-55987](https://issues.redhat.com/browse/OCPBUGS-55987): Fix impersonate group action [#15041](https://github.com/openshift/console/pull/15041)
* [Full changelog](https://github.com/openshift/console/compare/bd198ef0915477dadbe16d71d1277d5691773cf6...94c7d7c00db644607ecd97459add850e5247a309)


### [console-operator](https://github.com/openshift/console-operator/tree/0cb29273c8b1efec6ca591d5259a69d34e5ce51f)

* [OCPBUGS-56761](https://issues.redhat.com/browse/OCPBUGS-56761): Revert v1alpha1 removal [#991](https://github.com/openshift/console-operator/pull/991)
* [OCPBUGS-55716](https://issues.redhat.com/browse/OCPBUGS-55716): Fix issue where console operator orphans custom logo configmaps in openshift-console namespace [#985](https://github.com/openshift/console-operator/pull/985)
* [Full changelog](https://github.com/openshift/console-operator/compare/9af3e5fd7bbcb72975c7316bba38ea13c4937320...0cb29273c8b1efec6ca591d5259a69d34e5ce51f)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/fadb78e720779ed1b29f32170f3e9dd32584a7e6)

* [OCPBUGS-56082](https://issues.redhat.com/browse/OCPBUGS-56082): UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver [#2297](https://github.com/openshift/kubernetes/pull/2297)
* [OCPBUGS-56437](https://issues.redhat.com/browse/OCPBUGS-56437): Bump 4.19 1.32.5 [#2304](https://github.com/openshift/kubernetes/pull/2304)
* [OCPBUGS-56256](https://issues.redhat.com/browse/OCPBUGS-56256): UPSTREAM: 131495: Handle unsupported node expansion for RWX volumes [#2302](https://github.com/openshift/kubernetes/pull/2302)
* [Full changelog](https://github.com/openshift/kubernetes/compare/9fe7dfdeb6714effef45be12ec451a0f06893660...fadb78e720779ed1b29f32170f3e9dd32584a7e6)


### [hypershift](https://github.com/openshift/hypershift/tree/dec319950a1f662305191f981ff087097312fe33)

* [OCPBUGS-56792](https://issues.redhat.com/browse/OCPBUGS-56792): Fix CatalogSource image check when unauthorized [#6198](https://github.com/openshift/hypershift/pull/6198)
* [OCPBUGS-56910](https://issues.redhat.com/browse/OCPBUGS-56910): util/version: Add Version420 [#6215](https://github.com/openshift/hypershift/pull/6215)
* [OCPBUGS-56910](https://issues.redhat.com/browse/OCPBUGS-56910): Move EnsurePSANotPrivileged to AtLeast(t, Version420) [#6212](https://github.com/openshift/hypershift/pull/6212)
* [CNTRLPLANE-831](https://issues.redhat.com/browse/CNTRLPLANE-831): feat(konflux): add arm64 builds to cpo pipeline [#6182](https://github.com/openshift/hypershift/pull/6182)
* [OCPBUGS-56777](https://issues.redhat.com/browse/OCPBUGS-56777): Disable PSA enforcement in 4.19 hosted cluster [#6201](https://github.com/openshift/hypershift/pull/6201)
* [OCPBUGS-56458](https://issues.redhat.com/browse/OCPBUGS-56458): switch termination message policy to TerminationMessageFallbackToLogsOnError for debugability [#6170](https://github.com/openshift/hypershift/pull/6170)
* [OCPBUGS-56562](https://issues.redhat.com/browse/OCPBUGS-56562): Do not validate OCP API Server SANS if PKI reconciliation is disabled [#6178](https://github.com/openshift/hypershift/pull/6178)
* [CNTRLPLANE-831](https://issues.redhat.com/browse/CNTRLPLANE-831): Red Had Konflux control-plane-operator-4-19 intial pipeline [#6181](https://github.com/openshift/hypershift/pull/6181)
* [CNTRLPLANE-916](https://issues.redhat.com/browse/CNTRLPLANE-916): Konflux build pipeline service account migration [#6089](https://github.com/openshift/hypershift/pull/6089)
* [CNTRLPLANE-915](https://issues.redhat.com/browse/CNTRLPLANE-915): chore(deps): update konflux references [#6139](https://github.com/openshift/hypershift/pull/6139)
* [OCPBUGS-55789](https://issues.redhat.com/browse/OCPBUGS-55789): [release-4.19] Update KAS structured authentication configuration logic to use new uid and extras fields [#6121](https://github.com/openshift/hypershift/pull/6121)
* [Full changelog](https://github.com/openshift/hypershift/compare/d42b1a3da546e231ee6f8dd7162cca433fa2e444...dec319950a1f662305191f981ff087097312fe33)


### [insights-operator](https://github.com/openshift/insights-operator/tree/fa84a57ac4c8c47cb70dc07c4e9c812aaee98e49)

* feat: ensure the etc-entitlement-pki secret exists (#1087) [#1087](https://github.com/openshift/insights-operator/pull/1087)
* [Full changelog](https://github.com/openshift/insights-operator/compare/b1e0f8fce485de56a28f27793fa2bcec87a72771...fa84a57ac4c8c47cb70dc07c4e9c812aaee98e49)


### [ironic](https://github.com/openshift/ironic-image/tree/fe31e71dbbbd24c77adaecdc3d4d895375a611a5)

* Bug OCPBUGS-56639: Bump sushy to include SuperMicro Cd boot device string workaround [#660](https://github.com/openshift/ironic-image/pull/660)
* [Full changelog](https://github.com/openshift/ironic-image/compare/8a2091a6cfd25a6bc91b0714de25af904cc733ee...fe31e71dbbbd24c77adaecdc3d4d895375a611a5)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/bccdc7e7382c5958f040769d7ff20ab27ece5bdf)

* [OCPBUGS-56829](https://issues.redhat.com/browse/OCPBUGS-56829): Only update boot disks during GCP boot image updates [#5088](https://github.com/openshift/machine-config-operator/pull/5088)
* [OCPBUGS-56445](https://issues.redhat.com/browse/OCPBUGS-56445): Boot Image Controller should not degrade when golden configmap is slow to update [#5063](https://github.com/openshift/machine-config-operator/pull/5063)
* [OCPBUGS-56632](https://issues.redhat.com/browse/OCPBUGS-56632): daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers [#5076](https://github.com/openshift/machine-config-operator/pull/5076)
* [OCPBUGS-56035](https://issues.redhat.com/browse/OCPBUGS-56035): Only populate `Status.PinnedImageSets.CurrentGeneration` on valid generation value [#5039](https://github.com/openshift/machine-config-operator/pull/5039)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/7ef676ce0b13a25c6572d4595d92fd487dbc98b5...bccdc7e7382c5958f040769d7ff20ab27ece5bdf)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/e69a044ba8849095880303dee620b62958912e36)

* [OCPBUGS-56185](https://issues.redhat.com/browse/OCPBUGS-56185): [release-4.19] v2: bump containers/common dep to 0.63.0 (#1148) [#1148](https://github.com/openshift/oc-mirror/pull/1148)
* disables the signature verification on operator catalog collection (#1157) [#1157](https://github.com/openshift/oc-mirror/pull/1157)
* [OCPBUGS-56433](https://issues.redhat.com/browse/OCPBUGS-56433): v2/cli: always remove past archives before m2d (#1152) [#1152](https://github.com/openshift/oc-mirror/pull/1152)
* [OCPBUGS-56563](https://issues.redhat.com/browse/OCPBUGS-56563): v2/archive: print unarchive progress (#1158) [#1158](https://github.com/openshift/oc-mirror/pull/1158)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/85c1426f7cf9f3a943468ff88bc6e8264cca5dd2...e69a044ba8849095880303dee620b62958912e36)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/18061bfe9586919421ed2bb342d9b326b1002bd7)

* [OCPBUGS-56494](https://issues.redhat.com/browse/OCPBUGS-56494): Fix image reference in TestImageStreamImportQuayIO [#510](https://github.com/openshift/openshift-apiserver/pull/510)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/85f6eb2719a0440565c8b7bf00de954eeb12fdd9...18061bfe9586919421ed2bb342d9b326b1002bd7)


### [tests](https://github.com/openshift/origin/tree/33fe530740e17ef0332e874544a0f0d153be7e53)

* [OCPBUGS-56886](https://issues.redhat.com/browse/OCPBUGS-56886): Fix bearer token exposure in exit condition as well [#29841](https://github.com/openshift/origin/pull/29841)
* [OCPBUGS-56437](https://issues.redhat.com/browse/OCPBUGS-56437): Update to kubernetes 1.32.5 [#29875](https://github.com/openshift/origin/pull/29875)
* [OCPBUGS-56796](https://issues.redhat.com/browse/OCPBUGS-56796): Skip failing test [release-4.19] [#29865](https://github.com/openshift/origin/pull/29865)
* [OCPBUGS-56045](https://issues.redhat.com/browse/OCPBUGS-56045): OLMv1: Update test bundles [release-4.19] [#29836](https://github.com/openshift/origin/pull/29836)
* [OCPBUGS-56662](https://issues.redhat.com/browse/OCPBUGS-56662): Fix failed etcd test on arbiter ci run [#29826](https://github.com/openshift/origin/pull/29826)
* [OCPBUGS-56399](https://issues.redhat.com/browse/OCPBUGS-56399): fix watch request counts [#29799](https://github.com/openshift/origin/pull/29799)
* [Full changelog](https://github.com/openshift/origin/compare/65422c86f13fbdccca00adf5cfc570b37a2aebb3...33fe530740e17ef0332e874544a0f0d153be7e53)