# 4.19.0-okd-scos.16

Created: 2025-08-25 08:10:05 +0000 UTC

Image Digest: `sha256:31666722dd7eeb9a63cc2fe368cbcb20c9f006a33651b21ed531de87df79f012`

Promoted from registry.ci.openshift.org/origin/release-scos:4.19.0-0.okd-scos-2025-08-22-102022


## Changes from 4.19.0-okd-scos.15

### Components

* Kubectl 1.32.1
* Kubernetes 1.32.7
* Kubernetes Tests 1.32.6
* CentOS Stream CoreOS upgraded from 9.0.20250731-1 to 9.0.20250819-0


### Rebuilt images without code change

* [stream-coreos](https://github.com/openshift/os) git [e97898c8](https://github.com/openshift/os/commit/e97898c8af9cad8e5375e4860a7d79c39a1c79fa) `sha256:143d1e4eef1beddb4e4d34c2ee2f328a6799ac49df8e2b322094ae5813d84bdd`
* [stream-coreos-extensions](https://github.com/openshift/os) git [e97898c8](https://github.com/openshift/os/commit/e97898c8af9cad8e5375e4860a7d79c39a1c79fa) `sha256:68ccbfcee8c25ef62a903128de881b581ade4942104e64066ca02e057ed4fce1`


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/d40dbe053afda2205b6e94ece20c335afd57f61c)

* Revert "Update RHCOS 4.19 bootimage metadata to 9.6.20250811-0" [#9906](https://github.com/openshift/installer/pull/9906)
* [OCPBUGS-60402](https://issues.redhat.com/browse/OCPBUGS-60402): baremetal: always set external v6 URL on dualstack [#9879](https://github.com/openshift/installer/pull/9879)
* [OCPBUGS-58905](https://issues.redhat.com/browse/OCPBUGS-58905): Update RHCOS 4.19 bootimage metadata to 9.6.20250811-0 [#9888](https://github.com/openshift/installer/pull/9888)
* [Full changelog](https://github.com/openshift/installer/compare/249d7428c51fe85cabdab6394c4aed86fc24d398...d40dbe053afda2205b6e94ece20c335afd57f61c)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/2f969c7a1df33a398298df731505a508ad120db9)

* [OCPBUGS-60110](https://issues.redhat.com/browse/OCPBUGS-60110): Re-add ENABLE_NODEIP_DEBUG env var [#365](https://github.com/openshift/baremetal-runtimecfg/pull/365)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/33a1d92344c6b56721a745fbe2e41d3ca899aa78...2f969c7a1df33a398298df731505a508ad120db9)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/dd9b5c3785154a172607d15997df2b1e6ae54d53)

* [OCPBUGS-60617](https://issues.redhat.com/browse/OCPBUGS-60617): ccoctl azure dnszone-resource-group-name now optional [#900](https://github.com/openshift/cloud-credential-operator/pull/900)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/a5d62675b21911cdff2bfd257a85ef0b5a793731...dd9b5c3785154a172607d15997df2b1e6ae54d53)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/38dbc972321dd339464ffd4a92d2bb6f9b01d761)

* [OCPBUGS-60286](https://issues.redhat.com/browse/OCPBUGS-60286): Remove webhookport (9447) as HostPort [#498](https://github.com/openshift/cluster-baremetal-operator/pull/498)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/0c3beae1a216187270d60af49117a82e74de4020...38dbc972321dd339464ffd4a92d2bb6f9b01d761)


### [cluster-config-api](https://github.com/openshift/api/tree/1c614f54419fa23266ae2f6660b9034893749079)

* [OCPBUGS-60414](https://issues.redhat.com/browse/OCPBUGS-60414): MachineOSConfig name should match MachineConfigPool [#2449](https://github.com/openshift/api/pull/2449)
* Update crd-schema.json to release 1.33 branch [#2447](https://github.com/openshift/api/pull/2447)
* [Full changelog](https://github.com/openshift/api/compare/97812373b6b447ff6b55d3e2625b4f62aff1a16f...1c614f54419fa23266ae2f6660b9034893749079)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/3335b120ecbae4a792373a814474aeebde58d6c2)

* [OCPBUGS-60517](https://issues.redhat.com/browse/OCPBUGS-60517): fix(azure): resolve credential caching issues around UAMI support [#1243](https://github.com/openshift/cluster-image-registry-operator/pull/1243)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/328419e7a2aba288a3405e76449f84d42b1952b3...3335b120ecbae4a792373a814474aeebde58d6c2)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/ddd78734833eb45f2cd5fba677fe50e4ae9f063b)

* [NE-2102](https://issues.redhat.com/browse/NE-2102): Bump to OSSM 3.1.0 and Istio 1.26.2 [#1264](https://github.com/openshift/cluster-ingress-operator/pull/1264)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/beb84efd63f1600ac6c475decc979c63dbdaeb12...ddd78734833eb45f2cd5fba677fe50e4ae9f063b)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/bc62016ccc39a66406caf5110ac7140f285fb264)

* [OCPBUGS-60761](https://issues.redhat.com/browse/OCPBUGS-60761): Allow overriding OVN-Kubernetes configuration [#2781](https://github.com/openshift/cluster-network-operator/pull/2781)
* [OCPBUGS-60534](https://issues.redhat.com/browse/OCPBUGS-60534): Fix multus webhook match condition for spec changes [#2777](https://github.com/openshift/cluster-network-operator/pull/2777)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/f17bb7a589e7a9516c35aa0a3bd1bbc55f071ebd...bc62016ccc39a66406caf5110ac7140f285fb264)


### [console](https://github.com/openshift/console/tree/e3e13ec5d7f2ca0fa6167c2057ea1162ebc30ef1)

* [OCPBUGS-60279](https://issues.redhat.com/browse/OCPBUGS-60279): Remove ancient `X-XSS-Protection` header [#15381](https://github.com/openshift/console/pull/15381)
* [OCPBUGS-60038](https://issues.redhat.com/browse/OCPBUGS-60038): Resolving API Version Conflicts in Tekton Pipeline Runs [#15354](https://github.com/openshift/console/pull/15354)
* [OCPBUGS-60294](https://issues.redhat.com/browse/OCPBUGS-60294): OpenShift Console's "Start Job" action overrides configured "backoffLimit" to "6" [#15382](https://github.com/openshift/console/pull/15382)
* NO-JIRA: Update CHANGELOG for latest 4.19 plugin SDK package publish [#15406](https://github.com/openshift/console/pull/15406)
* [OCPBUGS-60039](https://issues.redhat.com/browse/OCPBUGS-60039): Fix i18n string for event stream (again) [#15388](https://github.com/openshift/console/pull/15388)
* [Full changelog](https://github.com/openshift/console/compare/8e996e840bcb9ec7bc2820c73e0703d88e443121...e3e13ec5d7f2ca0fa6167c2057ea1162ebc30ef1)


### [coredns](https://github.com/openshift/coredns/tree/4f64931403bf747b78bccb40ad877b08da534e23)

* [OCPBUGS-60246](https://issues.redhat.com/browse/OCPBUGS-60246): UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy [#148](https://github.com/openshift/coredns/pull/148)
* [Full changelog](https://github.com/openshift/coredns/compare/74776b850522c912db5fbadf7353f1eab669bd2a...4f64931403bf747b78bccb40ad877b08da534e23)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/97b7f2e2ecbbf844812a7158086030bfff2bd324)

* [OCPBUGS-60074](https://issues.redhat.com/browse/OCPBUGS-60074): UPSTREAM: 132028: podresources: list: use active pods [#2391](https://github.com/openshift/kubernetes/pull/2391)
* [Full changelog](https://github.com/openshift/kubernetes/compare/138db5223eea57e4408598a32320896c216724e1...97b7f2e2ecbbf844812a7158086030bfff2bd324)


### [hypershift](https://github.com/openshift/hypershift/tree/62e32ad788770817206f19490a2478f3e1acd7c2)

* [OCPBUGS-60648](https://issues.redhat.com/browse/OCPBUGS-60648): Cache Azure KMS TokenCredential for ARO HCP and clarify CPO credentials cache naming [#6677](https://github.com/openshift/hypershift/pull/6677)
* [OCPBUGS-60100](https://issues.redhat.com/browse/OCPBUGS-60100): fix: add dynamic security context uid to 4.19 missing components [#6675](https://github.com/openshift/hypershift/pull/6675)
* [OCPBUGS-57141](https://issues.redhat.com/browse/OCPBUGS-57141): HCP payload doesn't respect multiple mirrors [#6517](https://github.com/openshift/hypershift/pull/6517)
* [CNTRLPLANE-1270](https://issues.redhat.com/browse/CNTRLPLANE-1270): Red Hat Konflux update control-plane-operator-4-19 [#6660](https://github.com/openshift/hypershift/pull/6660)
* Red Hat Konflux purge control-plane-operator-4-19 [#6659](https://github.com/openshift/hypershift/pull/6659)
* [CNTRLPLANE-1267](https://issues.redhat.com/browse/CNTRLPLANE-1267): conditional builds for mce-2.9 [#6657](https://github.com/openshift/hypershift/pull/6657)
* [OCPBUGS-57588](https://issues.redhat.com/browse/OCPBUGS-57588): Update PSA from v1beta1 to v1 [#6302](https://github.com/openshift/hypershift/pull/6302)
* [OCPBUGS-59805](https://issues.redhat.com/browse/OCPBUGS-59805): Router publish strategy related changes for IBM Cloud platform [#6490](https://github.com/openshift/hypershift/pull/6490)
* [OCPBUGS-59933](https://issues.redhat.com/browse/OCPBUGS-59933): Use the image reference for the cache in the image metadata provider [#6535](https://github.com/openshift/hypershift/pull/6535)
* [CNTRLPLANE-1016](https://issues.redhat.com/browse/CNTRLPLANE-1016): Support day2 tags changes for AWS default SecurityGroup [#6455](https://github.com/openshift/hypershift/pull/6455)
* [Full changelog](https://github.com/openshift/hypershift/compare/7ed7c357e69292e169686f009a516c4bad55a0ff...62e32ad788770817206f19490a2478f3e1acd7c2)


### [insights-operator](https://github.com/openshift/insights-operator/tree/9fd1106b89d42891e4aa4eec7a1f328b211b83fe)

* feat: add permissions to gather clusterrole (#1112) [#1112](https://github.com/openshift/insights-operator/pull/1112)
* fix: incorrect anonymization of domains (#1114) [#1114](https://github.com/openshift/insights-operator/pull/1114)
* [Full changelog](https://github.com/openshift/insights-operator/compare/8fffce910f39cf33efa97a24a894c84cf3f3d1f6...9fd1106b89d42891e4aa4eec7a1f328b211b83fe)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/7cf9bf8a41b97b6defea060cda71968378dd2fbb)

* fix for OCPBUGS-60427: userDataSecret.name should be a Required value on AWS [#1403](https://github.com/openshift/machine-api-operator/pull/1403)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/7cf7a446c086a97cb15766cb100b468573192b8e...7cf9bf8a41b97b6defea060cda71968378dd2fbb)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/366ecc0d61006b46a8e05cddb8dfffd5e347a09b)

* [OCPBUGS-60265](https://issues.redhat.com/browse/OCPBUGS-60265): Reintroduce cronjob that deletes MCN v1alpha1 CRD [#5243](https://github.com/openshift/machine-config-operator/pull/5243)
* [OCPBUGS-60224](https://issues.redhat.com/browse/OCPBUGS-60224): Invalid architecture value found in annotation during 4.19 update [#5227](https://github.com/openshift/machine-config-operator/pull/5227)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/1b3ce4ea5b1943283ed703f55800a8f08d26e4a8...366ecc0d61006b46a8e05cddb8dfffd5e347a09b)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/345d64d597581eb0cb3cd2c1cf06124446da79a5)

* NO-JIRA: [release-4.19] OCPBUGS-60296: fix legend height to avoid scroll overlap [#498](https://github.com/openshift/monitoring-plugin/pull/498)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/91b1cbb53007ae7ccd8f81d58f4485e34c28cb2d...345d64d597581eb0cb3cd2c1cf06124446da79a5)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/44400131ce00a1710bb91eba860cc6b6da5b1ee7)

* [OCPBUGS-59976](https://issues.redhat.com/browse/OCPBUGS-59976): v2/operator: support manifest lists with one arch (#1230) [#1230](https://github.com/openshift/oc-mirror/pull/1230)
* [OCPBUGS-59949](https://issues.redhat.com/browse/OCPBUGS-59949): fixes the result output showing the wrong total (#1237) [#1237](https://github.com/openshift/oc-mirror/pull/1237)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/e91ec32c8c0195393280c734ba46de5a31637479...44400131ce00a1710bb91eba860cc6b6da5b1ee7)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/5c83a8adfd3fb0a5b3f2f8a26d3d05eefd5ba9d0)

* [OCPBUGS-60525](https://issues.redhat.com/browse/OCPBUGS-60525): Add NetworkPolicy as a supported kind [#1047](https://github.com/openshift/operator-framework-olm/pull/1047)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/8bcf1556a550efa7bb380ec315c077cf29438695...5c83a8adfd3fb0a5b3f2f8a26d3d05eefd5ba9d0)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/1e27e7a22ddb5a30fe5ae7ccb8e1d3967bc645ec)

* [OCPBUGS-48709](https://issues.redhat.com/browse/OCPBUGS-48709): DownStream Merge Sync from 4.20 [08-06-2025] [#2704](https://github.com/openshift/ovn-kubernetes/pull/2704)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/e24389403dd961a14b6512e40cda7e3e5d0a4b20...1e27e7a22ddb5a30fe5ae7ccb8e1d3967bc645ec)


### [tests](https://github.com/openshift/origin/tree/388322d76352c70a802a2b4cd358e7726746ef90)

* [OCPBUGS-60569](https://issues.redhat.com/browse/OCPBUGS-60569): images/tests: Remove rteval [#30124](https://github.com/openshift/origin/pull/30124)
* [OCPBUGS-60429](https://issues.redhat.com/browse/OCPBUGS-60429): Load our MCO's OTE binary [#30043](https://github.com/openshift/origin/pull/30043)
* [OCPBUGS-59757](https://issues.redhat.com/browse/OCPBUGS-59757): OCPBUGS-59758: Improve MCN test stability [#30018](https://github.com/openshift/origin/pull/30018)
* [OCPBUGS-60117](https://issues.redhat.com/browse/OCPBUGS-60117): Enable test for LGW L2 [#30052](https://github.com/openshift/origin/pull/30052)
* [OCPBUGS-60234](https://issues.redhat.com/browse/OCPBUGS-60234): Move the legacy container failures [#30073](https://github.com/openshift/origin/pull/30073)
* [Full changelog](https://github.com/openshift/origin/compare/1a15c85aaa9f0b6c1e7ed2f9776a6c1d98b5cb1f...388322d76352c70a802a2b4cd358e7726746ef90)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/4f3a1da10d7f060f4b6530e70bd03892d9c43277)

* [OCPBUGS-60535](https://issues.redhat.com/browse/OCPBUGS-60535): Check for number of FailureDomain-s in GetVCenter() [#188](https://github.com/openshift/vsphere-problem-detector/pull/188)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/32b15d87f5fd387dd5d04b96b7250a353240bf92...4f3a1da10d7f060f4b6530e70bd03892d9c43277)