# 4.20.0-okd-scos.17

Created: 2026-01-12 05:30:37 +0000 UTC

Image Digest: `sha256:b52285e69a91c2ec67567a3576611e986577e03977f8dd28cf1dc679ae6856dd`

Promoted from registry.ci.openshift.org/origin/release-scos:4.20.0-0.okd-scos-2026-01-09-111956


## Changes from 4.20.0-okd-scos.13

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.6
* Kubernetes Tests 1.33.4
* CentOS Stream CoreOS 10.0.20251023-0



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| PreconfiguredUDNAddresses <br/> (10 tests)| Enabled<br/>(Changed)| Enabled<br/>(Changed)| Enabled| Enabled| Enabled| Enabled |


### Rebuilt images without code change

* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [088dcaf7](https://github.com/openshift/aws-encryption-provider/commit/088dcaf73f980b977ef4f5d2f99e2a93deb87eef) `sha256:ea4d5d880904d4c4de3731ef7e9fb46397e08dad0f7a394c5096b938e8673812`


### [agent-installer-utils](https://github.com/openshift/agent-installer-utils/tree/523e7d76637bd70cec447e7ce4655bf2bfee9272)

* [OCPBUGS-69834](https://issues.redhat.com/browse/OCPBUGS-69834): Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 20eb21c [#208](https://github.com/openshift/agent-installer-utils/pull/208)
* [OCPBUGS-69830](https://issues.redhat.com/browse/OCPBUGS-69830): Update Konflux references [#207](https://github.com/openshift/agent-installer-utils/pull/207)
* [OCPBUGS-67306](https://issues.redhat.com/browse/OCPBUGS-67306): Update Konflux release version to 4.20.8 [#212](https://github.com/openshift/agent-installer-utils/pull/212)
* [Full changelog](https://github.com/openshift/agent-installer-utils/compare/6ce70bd6d29f2f0b72884d3cc896c6bbae258b95...523e7d76637bd70cec447e7ce4655bf2bfee9272)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/db608c3e6a8817e3304bf16c2f4d9661d9bb35cb)

* [OCPBUGS-71212](https://issues.redhat.com/browse/OCPBUGS-71212): Increase agent-installer pre-network-manager timeout [#10199](https://github.com/openshift/installer/pull/10199)
* [OCPBUGS-65767](https://issues.redhat.com/browse/OCPBUGS-65767): Add StandardFXmdsv2Family to azure tested instance type list [#10104](https://github.com/openshift/installer/pull/10104)
* [Full changelog](https://github.com/openshift/installer/compare/cc82f30cd640577297f66b5df80f0e08c55fd3fa...db608c3e6a8817e3304bf16c2f4d9661d9bb35cb)


### [baremetal-operator](https://github.com/openshift/baremetal-operator/tree/8000d7e910a6c08481beca722074d12419e25edf)

* [OCPBUGS-69667](https://issues.redhat.com/browse/OCPBUGS-69667): Change architecture default to match controller [#440](https://github.com/openshift/baremetal-operator/pull/440)
* [Full changelog](https://github.com/openshift/baremetal-operator/compare/a7d0035a144d5b51c1401426bbe7ce518f24f154...8000d7e910a6c08481beca722074d12419e25edf)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/dd59e1f8ff03f03fc7a79946ef005fe79ca44379)

* [OCPBUGS-71203](https://issues.redhat.com/browse/OCPBUGS-71203): Mount /etc/pki/ca-trust to machine-os-images & Enable runtime extraction of aarch64 images [#543](https://github.com/openshift/cluster-baremetal-operator/pull/543)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/2c9f77f2a7fe3c7233a50b2ba0acb3155f9d34bb...dd59e1f8ff03f03fc7a79946ef005fe79ca44379)


### [cluster-config-api](https://github.com/openshift/api/tree/50517c6f4bfdbf9fc2cb291fd97cce150a3237ca)

* [CORENET-6431](https://issues.redhat.com/browse/CORENET-6431): network, virt: Graduate PreconfiguredUDNAddresses feature gate [#2546](https://github.com/openshift/api/pull/2546)
* [Full changelog](https://github.com/openshift/api/compare/1cb53e34ca33d020c765093c21c9b7f4502cbea7...50517c6f4bfdbf9fc2cb291fd97cce150a3237ca)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/24ef5ae121b8f658b649bb555be827f114ead438)

* NO-JIRA: Add new NID team members to OWNERS [#1317](https://github.com/openshift/cluster-ingress-operator/pull/1317)
* [OCPBUGS-66135](https://issues.redhat.com/browse/OCPBUGS-66135): Implement HTTPKeepAliveTimeout tuning option [#1312](https://github.com/openshift/cluster-ingress-operator/pull/1312)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/fb7482e49c790206e370494221b7b02dc50bfd84...24ef5ae121b8f658b649bb555be827f114ead438)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/47ab4cb2b5bb27718150b82bb3e0a03755200ca3)

* [OCPBUGS-67166](https://issues.redhat.com/browse/OCPBUGS-67166): Add the collection of MTV migration metrics [#2772](https://github.com/openshift/cluster-monitoring-operator/pull/2772)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/870b44fc269ae4e790a3487d1795880d93ff72a9...47ab4cb2b5bb27718150b82bb3e0a03755200ca3)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/dbd9826dbe5373bd3605dfef606d118ffc65b830)

* [OCPBUGS-66253](https://issues.redhat.com/browse/OCPBUGS-66253): Add kubevirt platform to dual-stack supported platforms [#2860](https://github.com/openshift/cluster-network-operator/pull/2860)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/698e349cb60e84967bf93345d1b0802dd15ccc1a...dbd9826dbe5373bd3605dfef606d118ffc65b830)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/ae91d95f908377c7852d44249364d59b6f3bd14d)

* [OCPBUGS-64832](https://issues.redhat.com/browse/OCPBUGS-64832): e2e:hugepages: changing tests to use hugepages-allocator tool [#1427](https://github.com/openshift/cluster-node-tuning-operator/pull/1427)
* [OCPBUGS-64588](https://issues.redhat.com/browse/OCPBUGS-64588): e2e:llc: skip test when no BM worker is found [#1422](https://github.com/openshift/cluster-node-tuning-operator/pull/1422)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/2ed182ba57106a7c8cc727aa003e46be079b7dd9...ae91d95f908377c7852d44249364d59b6f3bd14d)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/73583cd49830e22349b5d8bf25dc2e95f3882692)

* [OCPBUGS-70180](https://issues.redhat.com/browse/OCPBUGS-70180): [release-4.20] OCPBUGS-70180: Unify capitalization when comparing architectures for available updates [#1281](https://github.com/openshift/cluster-version-operator/pull/1281)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/77782f1a4b9648f8ade2bc1e75d10779784e341f...73583cd49830e22349b5d8bf25dc2e95f3882692)


### [console](https://github.com/openshift/console/tree/e46a42a6b67699f738fb8854fad3f64d3dbd39a3)

* [OCPBUGS-69732](https://issues.redhat.com/browse/OCPBUGS-69732): Fix Helm chart installation with CA/TLS certificates [#15862](https://github.com/openshift/console/pull/15862)
* [OCPBUGS-70332](https://issues.redhat.com/browse/OCPBUGS-70332): Visiting Group Detail Page &gt; RoleBindings will show error [#15887](https://github.com/openshift/console/pull/15887)
* [OCPBUGS-67136](https://issues.redhat.com/browse/OCPBUGS-67136): Spread operand details across 2 col [#15858](https://github.com/openshift/console/pull/15858)
* [OCPBUGS-66427](https://issues.redhat.com/browse/OCPBUGS-66427): Update client initialization in checkPackageManifestHandler [#15822](https://github.com/openshift/console/pull/15822)
* [Full changelog](https://github.com/openshift/console/compare/5f07ad2930130fd041b2114e0eb3f78ad75ad2be...e46a42a6b67699f738fb8854fad3f64d3dbd39a3)


### [console-operator](https://github.com/openshift/console-operator/tree/ac81d030ea60351838be670de5ddca92a0320d45)

* [OCPBUGS-69960](https://issues.redhat.com/browse/OCPBUGS-69960): Reset StorageVersionMigrationDegraded condition [#1085](https://github.com/openshift/console-operator/pull/1085)
* [OCPBUGS-69654](https://issues.redhat.com/browse/OCPBUGS-69654): Update path for browsing catalogs and operators in quickstarts. [#1083](https://github.com/openshift/console-operator/pull/1083)
* [Full changelog](https://github.com/openshift/console-operator/compare/cdbc995ad9906b20a6048630d5d8af285bad7cc5...ac81d030ea60351838be670de5ddca92a0320d45)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/33a825ebe5da727e8ccce0fb3c9d33fce7c6bdd9)

* [OCPBUGS-61843](https://issues.redhat.com/browse/OCPBUGS-61843): UPSTREAM: 131850: cpumanager: uncorecache alignment for odd integer cpus [#2498](https://github.com/openshift/kubernetes/pull/2498)
* [Full changelog](https://github.com/openshift/kubernetes/compare/2a7ef4adf7d3074804e6666221bc7c73c2c89ca1...33a825ebe5da727e8ccce0fb3c9d33fce7c6bdd9)


### [hypershift](https://github.com/openshift/hypershift/tree/0877ad678ffc7687c02ce8e890d35f2e2206f9eb)

* [OCPBUGS-66409](https://issues.redhat.com/browse/OCPBUGS-66409): test: Fix control plane components rollout failure when NetworkType is not OVNKubernetes [#7337](https://github.com/openshift/hypershift/pull/7337)
* [CNTRLPLANE-2205](https://issues.redhat.com/browse/CNTRLPLANE-2205): fix(hcco): allow for ARN reuse across components [#7383](https://github.com/openshift/hypershift/pull/7383)
* [OCPBUGS-69378](https://issues.redhat.com/browse/OCPBUGS-69378): test: remove network-dependent unit tests for image metadata [#7391](https://github.com/openshift/hypershift/pull/7391)
* [Full changelog](https://github.com/openshift/hypershift/compare/2a951d0352327e2f4f030595bc3011f3c0c5a809...0877ad678ffc7687c02ce8e890d35f2e2206f9eb)


### [ironic](https://github.com/openshift/ironic-image/tree/c6c2be3dbdedd8ab7c0b9701307c17df7d2bb591)

* [OCPBUGS-69786](https://issues.redhat.com/browse/OCPBUGS-69786): Bump eventlet version [#756](https://github.com/openshift/ironic-image/pull/756)
* [Full changelog](https://github.com/openshift/ironic-image/compare/1821ac0208c0af8decbfb5aa077b793b7222d102...c6c2be3dbdedd8ab7c0b9701307c17df7d2bb591)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/6ae9e9e35571eedf00c240e10f62b56bbac1af07)

* [OCPBUGS-69777](https://issues.redhat.com/browse/OCPBUGS-69777): Bump eventlet version [#228](https://github.com/openshift/ironic-agent-image/pull/228)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/eecc364b2a4abb6375fd41a9751c047d15aa7f63...6ae9e9e35571eedf00c240e10f62b56bbac1af07)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/8af0c84e6fcc34c60768b3955366a78a440b7a85)

* [OCPBUGS-70322](https://issues.redhat.com/browse/OCPBUGS-70322): Skip boot image updates if arch annotation is not found [#5525](https://github.com/openshift/machine-config-operator/pull/5525)
* [OCPBUGS-70349](https://issues.redhat.com/browse/OCPBUGS-70349): Remove the dead code of setting the operator status for cgroupv1 based clusters [#5446](https://github.com/openshift/machine-config-operator/pull/5446)
* [OCPBUGS-69666](https://issues.redhat.com/browse/OCPBUGS-69666): Remove log exposing kubeconfig [#5505](https://github.com/openshift/machine-config-operator/pull/5505)
* [OCPBUGS-69444](https://issues.redhat.com/browse/OCPBUGS-69444): MCP is not correctly degraded when a pivotError happens [#5503](https://github.com/openshift/machine-config-operator/pull/5503)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/3eb8e48748919195aaa65b415c21b05f6287fc8f...8af0c84e6fcc34c60768b3955366a78a440b7a85)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/b0bf464e64bc17bcd2f9d06e8d47d45915115624)

* [OU-1146](https://issues.redhat.com/browse/OU-1146): remove random multiplication [#704](https://github.com/openshift/monitoring-plugin/pull/704)
* [OU-1135](https://issues.redhat.com/browse/OU-1135): [release-4.20] monitoring testing backport [#700](https://github.com/openshift/monitoring-plugin/pull/700)
* [OCPBUGS-69725](https://issues.redhat.com/browse/OCPBUGS-69725): [release-4.20] fix: upgrade node-forge vulnerable dependency [#701](https://github.com/openshift/monitoring-plugin/pull/701)
* [OU-1130](https://issues.redhat.com/browse/OU-1130): Merge main to release 4.20 [#683](https://github.com/openshift/monitoring-plugin/pull/683)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/68bc2198076b3200a71469eb0b9544e1d363d03a...b0bf464e64bc17bcd2f9d06e8d47d45915115624)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/7df8cc9ca8362fecc840653bba092d02f15a19ed)

* [CNV-72230](https://issues.redhat.com/browse/CNV-72230): fix networking links [#308](https://github.com/openshift/networking-console-plugin/pull/308)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/619d169136e369b1d8d1f48f598ab713bac6b4bb...7df8cc9ca8362fecc840653bba092d02f15a19ed)


### [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack/tree/d1c8e7edf11e78db401bc1672e0f17d551fe09db)

* [OCPBUGS-64814](https://issues.redhat.com/browse/OCPBUGS-64814): Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.12 into release-4.20 [#381](https://github.com/openshift/cluster-api-provider-openstack/pull/381)
* [Full changelog](https://github.com/openshift/cluster-api-provider-openstack/compare/3bb292d0c612a59cb78061dc24dc7081c5119894...d1c8e7edf11e78db401bc1672e0f17d551fe09db)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/0d95a7ef5d73153f5593e67bc41c0c7a53567ee6)

* [OCPBUGS-62014](https://issues.redhat.com/browse/OCPBUGS-62014): rorfs for cacheless lacks write access to /tmp/ to generate cache [#1170](https://github.com/openshift/operator-framework-olm/pull/1170)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/dd6d22bd02554c039e7bbec4bf39c6e97ebf0b9b...0d95a7ef5d73153f5593e67bc41c0c7a53567ee6)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/1faf1ac5bb2e604f745d93a5fe70bec93024ad7f)

* [OCPBUGS-66049](https://issues.redhat.com/browse/OCPBUGS-66049): Fix conntrack reconciliation to use service port instead of endpoint port [#2874](https://github.com/openshift/ovn-kubernetes/pull/2874)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/6c78b6defbd606f8fdf002d7cc37e3d49c7bcd98...1faf1ac5bb2e604f745d93a5fe70bec93024ad7f)


### [tests](https://github.com/openshift/origin/tree/b3dfe24701b9b592b9c55153974804db7ec76459)

* [OCPBUGS-69686](https://issues.redhat.com/browse/OCPBUGS-69686): BeforeEach was indirectly called in DetermineReleasePayloadImage [#30620](https://github.com/openshift/origin/pull/30620)
* [Full changelog](https://github.com/openshift/origin/compare/f68cadc88290dd0e813736b75d1c1fe0f9d87a2b...b3dfe24701b9b592b9c55153974804db7ec76459)