The manual backport of cert rotation for whereabouts (https://github.com/openshift/cluster-network-operator/commit/d4fd19fdc7449d839393348c67ddca0693985e9e#diff-d9e6ed9711f0ab1ddb5bca711846cacb75269c8b5a081d0a3ff589fd33e57a79) contains a typo in the whereabouts-token-watcher release annotation key (note the "relase.openshift.io.version" key)

$ oc adm release info 4.17.45 --commits -ojsonpath='{.references.spec.tags[?(@.name=="cluster-network-operator")]}'|jq
{
  "annotations": {
    "io.openshift.build.commit.id": "45379d9f5db177cc97f6e856a97e8b24c8f7a23c",
    "io.openshift.build.commit.ref": "",
    "io.openshift.build.source-location": "https://github.com/openshift/cluster-network-operator"
  },
  "from": {
    "kind": "DockerImage",
    "name": "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:eb559867e463cfe76b923a45620f848327d9682b31ba03a8caacf28cc9390212"
  },
  "generation": null,
  "importPolicy": {},
  "name": "cluster-network-operator",
  "referencePolicy": {
    "type": ""
  }
}
$ git checkout 45379d9f5db177cc97f6e856a97e8b24c8f7a23c
HEAD is now at 45379d9f5 Merge pull request #2818 from martinkennelly/417-garp
$ grep -m1 'name: whereabouts-token-watcher' bindata/network/multus/multus.yaml -A7
  name: whereabouts-token-watcher
  namespace: openshift-multus
  annotations:
    kubernetes.io/description: |
      This deamon watches over the whereabouts service account token and CA
      file for changes and will regenerate a kubeconfig if changes are seen
    relase.openshift.io.version: "{{.ReleaseVersion}}"
spec:

    1.
    2.
    3.
    

Upgrading will be stuck since the release annotation is not properly picked up: https://github.com/openshift/cluster-network-operator/blob/1bec7869b6a707b34a4c717b242f118fc1ff8e5c/pkg/controller/statusmanager/pod_status.go#L114-L116