RHBA-2025:23103 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 4.20.8 is now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.8. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2025:23101

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

Solution

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

You can download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
can be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:91606a5f04331ed3293f71034d4f480e38645560534805fe5a821e6b64a3f203

(For s390x architecture)
The image digest is sha256:d8686226627288ba106c5468b6fe7e2a22f8fccb0866482f3bdf0d1657eafd4e

(For ppc64le architecture)
The image digest is sha256:4d1d531084fc58a91e662158d1f0f06f5868017e4805cebc543504c68265c42f

(For aarch64 architecture)
The image digest is sha256:dc5627be4c3ff678c9691d6e942beec7789fd1b64b94b99c8edda4c4dfef9492

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

• Red Hat OpenShift Container Platform

Fixes

• OCPBUGS-50672 - Tuned profile degraded on ARM cluster - Module kvm_intel not found
• OCPBUGS-61785 - Observing error in the openshift web console after upgrading the cluster from 4.18 to 4.19.
• OCPBUGS-61982 - [4.20] Pods in openshift-apiserver are unable to parse manifest due to unexpected end of JSON input
• OCPBUGS-62117 - [GCP-PD] Hyperdisk volume original size need to be larger than 6Gi when do resize/clone operation
• OCPBUGS-63495 - Cluster AutoScaler + CAPI Provider incorrectly interferes with MachineDeployment Replicas
• OCPBUGS-64647 - Not able to mirror specific version of 'redis-enterprise-operator-cert' operator
• OCPBUGS-64777 - [Origin] Add e2e tests for storage network policy
• OCPBUGS-64800 - [release-4.20][QEMUKubeVirtLauncherLogs]The VM pod that doesn't deliver any logs blocks the QEMU gathering
• OCPBUGS-65514 - deleted nodes still present in egressfirewalls managed fields
• OCPBUGS-65547 - [4.20] Adding ptp-operator must-gather to ART image references
• OCPBUGS-65551 - Bump to Kubernetes v1.33.6
• OCPBUGS-65577 - [4.20] synce4l is not available within lunuxptp daemon container
• OCPBUGS-65664 - IngressOperator not exposing some metrics for existing IngressController after Operator restart
• OCPBUGS-65680 - openshift-marketplace marketplace-operator-metrics endpoint 8081 port exposed all the information without any authorization
• OCPBUGS-65761 - [release-4.20] Perspective redirects have search params dropped
• OCPBUGS-65763 - [Azure UPI] contine the fix in 02_storage.json
• OCPBUGS-65793 - [release-4.20] OpenShift Console can only show user name instead of full name as the display name
• OCPBUGS-65798 - Azure custom role definitions can experience replication delays
• OCPBUGS-65862 - alarms-server fails to start with ACM 2.15 due to secret not existing
• OCPBUGS-65895 - [AWS EFS CSI Driver Operator] efs_tags_controller failed to refresh cached credentials on hypershift hosted cluster
• OCPBUGS-65898 - layered image update loops on failure to find systemd unit files, MCP degraded
• OCPBUGS-65900 - [release-4.20] Terminal disconnected when pod YAML changes (without pod restart)
• OCPBUGS-65947 - Changing the unit to Kb Mb in ocp 4.20 results in value coming as Undefined
• OCPBUGS-65951 - Fix linter issues, add missing cheryy-pick bits from work for OCPBUGS-64697
• OCPBUGS-66062 - [release-4.20] [QEMUKubeVirtLauncherLogs]The logs from error QEMU pod were not gathered
• OCPBUGS-66084 - [4.20] Fix broken OKD image
• OCPBUGS-66206 - [release-4.20] Tooltips and Sticky scroll doesn't update toggle input `checked` property in a real time
• OCPBUGS-66207 - Console message about UI URL is garbled
• OCPBUGS-66208 - Unconfigured ignition should not attempt to display cluster name on console
• OCPBUGS-66240 - monitoring-plugin pods fail TLS handshake after applying "modern" tlsSecurityProfile
• OCPBUGS-66257 - Bump Azure Marketplace Images to 4.20
• OCPBUGS-66365 - Marketplace operator creating more watch requests than previously
• OCPBUGS-66406 - Update Konflux files to build 4.20.6
• OCPBUGS-66422 - Update Konflux references
• OCPBUGS-66425 - Open Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 13cf619
• OCPBUGS-50672 - Tuned profile degraded on ARM cluster - Module kvm_intel not found
• OCPBUGS-61785 - Observing error in the openshift web console after upgrading the cluster from 4.18 to 4.19.
• OCPBUGS-61982 - [4.20] Pods in openshift-apiserver are unable to parse manifest due to unexpected end of JSON input
• OCPBUGS-62117 - [GCP-PD] Hyperdisk volume original size need to be larger than 6Gi when do resize/clone operation
• OCPBUGS-63495 - Cluster AutoScaler + CAPI Provider incorrectly interferes with MachineDeployment Replicas
• OCPBUGS-64647 - Not able to mirror specific version of 'redis-enterprise-operator-cert' operator
• OCPBUGS-64777 - [Origin] Add e2e tests for storage network policy
• OCPBUGS-64800 - [release-4.20][QEMUKubeVirtLauncherLogs]The VM pod that doesn't deliver any logs blocks the QEMU gathering
• OCPBUGS-65514 - deleted nodes still present in egressfirewalls managed fields
• OCPBUGS-65547 - [4.20] Adding ptp-operator must-gather to ART image references
• OCPBUGS-65551 - Bump to Kubernetes v1.33.6
• OCPBUGS-65577 - [4.20] synce4l is not available within lunuxptp daemon container
• OCPBUGS-65664 - IngressOperator not exposing some metrics for existing IngressController after Operator restart
• OCPBUGS-65680 - openshift-marketplace marketplace-operator-metrics endpoint 8081 port exposed all the information without any authorization
• OCPBUGS-65761 - [release-4.20] Perspective redirects have search params dropped
• OCPBUGS-65763 - [Azure UPI] contine the fix in 02_storage.json
• OCPBUGS-65793 - [release-4.20] OpenShift Console can only show user name instead of full name as the display name
• OCPBUGS-65798 - Azure custom role definitions can experience replication delays
• OCPBUGS-65862 - alarms-server fails to start with ACM 2.15 due to secret not existing
• OCPBUGS-65895 - [AWS EFS CSI Driver Operator] efs_tags_controller failed to refresh cached credentials on hypershift hosted cluster
• OCPBUGS-65898 - layered image update loops on failure to find systemd unit files, MCP degraded
• OCPBUGS-65900 - [release-4.20] Terminal disconnected when pod YAML changes (without pod restart)
• OCPBUGS-65947 - Changing the unit to Kb Mb in ocp 4.20 results in value coming as Undefined
• OCPBUGS-65951 - Fix linter issues, add missing cheryy-pick bits from work for OCPBUGS-64697
• OCPBUGS-66062 - [release-4.20] [QEMUKubeVirtLauncherLogs]The logs from error QEMU pod were not gathered
• OCPBUGS-66084 - [4.20] Fix broken OKD image
• OCPBUGS-66206 - [release-4.20] Tooltips and Sticky scroll doesn't update toggle input `checked` property in a real time
• OCPBUGS-66207 - Console message about UI URL is garbled
• OCPBUGS-66208 - Unconfigured ignition should not attempt to display cluster name on console
• OCPBUGS-66240 - monitoring-plugin pods fail TLS handshake after applying "modern" tlsSecurityProfile
• OCPBUGS-66257 - Bump Azure Marketplace Images to 4.20
• OCPBUGS-66365 - Marketplace operator creating more watch requests than previously
• OCPBUGS-66406 - Update Konflux files to build 4.20.6
• OCPBUGS-66422 - Update Konflux references
• OCPBUGS-66425 - Open Update quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2 Docker digest to 13cf619

CVEs

(none)

References

(none)