apiVersion: config.openshift.io/v1
kind: ClusterVersion
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"config.openshift.io/v1","kind":"ClusterVersion","metadata":{"annotations":{},"creationTimestamp":null,"name":"version"},"spec":{"clusterID":"6f32121c-f131-42aa-a5b8-868084af93cb","signatureStores":null},"status":{"availableUpdates":null,"capabilities":{},"desired":{"image":"","version":""},"observedGeneration":0,"versionHash":""}}
  creationTimestamp: "2025-11-07T21:39:31Z"
  generation: 3
  labels:
    hypershift.openshift.io/managed: "true"
  name: version
  resourceVersion: "2321518"
  uid: 0f0b739b-53ce-4cc9-875d-9433becb5503
spec:
  channel: fast-4.20
  clusterID: 6f32121c-f131-42aa-a5b8-868084af93cb
status:
  availableUpdates:
  - channels:
    - candidate-4.19
    - candidate-4.20
    - eus-4.20
    - fast-4.19
    - fast-4.20
    - stable-4.19
    - stable-4.20
    image: quay.io/openshift-release-dev/ocp-release@sha256:d909f94e2a0a72414184cf802e42fb466172ddcc0a3ab6cfcf73f238d783697e
    url: https://access.redhat.com/errata/RHBA-2025:15293
    version: 4.19.11
  capabilities:
    enabledCapabilities:
    - Build
    - CSISnapshot
    - CloudControllerManager
    - CloudCredential
    - Console
    - DeploymentConfig
    - ImageRegistry
    - Ingress
    - Insights
    - MachineAPI
    - NodeTuning
    - OperatorLifecycleManager
    - OperatorLifecycleManagerV1
    - Storage
    - baremetal
    - marketplace
    - openshift-samples
    knownCapabilities:
    - Build
    - CSISnapshot
    - CloudControllerManager
    - CloudCredential
    - Console
    - DeploymentConfig
    - ImageRegistry
    - Ingress
    - Insights
    - MachineAPI
    - NodeTuning
    - OperatorLifecycleManager
    - OperatorLifecycleManagerV1
    - Storage
    - baremetal
    - marketplace
    - openshift-samples
  conditionalUpdates:
  - conditions:
    - lastTransitionTime: "2025-11-17T19:09:56Z"
      message: |-
        Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
          NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483
      reason: EvaluationFailed
      status: Unknown
      type: Recommended
    release:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:eef1007b491a06505d8931e2c1d51325437e17d92f470a3ca4232e615f88a902
      url: https://access.redhat.com/errata/RHBA-2025:19301
      version: 4.19.18
    risks:
    - matchingRules:
      - promql:
          promql: |
            topk by (_id) (1,
              group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
              or on (_id)
              0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
            )
            * on (_id) group_left (name)
            (
              group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
              or on (_id)
              group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
              or on (_id)
              0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
              or on (_id)
              0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
            )
        type: PromQL
      message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
        updates, breaking Kubernetes access to those Nodes and wedging the update
        into the exposed release.
      name: NetworkManagerOVNBridgeMapping
      url: https://issues.redhat.com/browse/CORENET-6483
  - conditions:
    - lastTransitionTime: "2025-11-17T19:09:56Z"
      message: |-
        Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
          NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483
      reason: EvaluationFailed
      status: Unknown
      type: Recommended
    release:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:2128e8aeb605ef6360fd48d25172ccbaaf3450122e1fc0131fe6c39a0f217282
      url: https://access.redhat.com/errata/RHSA-2025:18233
      version: 4.19.17
    risks:
    - matchingRules:
      - promql:
          promql: |
            topk by (_id) (1,
              group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
              or on (_id)
              0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
            )
            * on (_id) group_left (name)
            (
              group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
              or on (_id)
              group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
              or on (_id)
              0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
              or on (_id)
              0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
            )
        type: PromQL
      message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
        updates, breaking Kubernetes access to those Nodes and wedging the update
        into the exposed release.
      name: NetworkManagerOVNBridgeMapping
      url: https://issues.redhat.com/browse/CORENET-6483
  - conditions:
    - lastTransitionTime: "2025-11-17T19:09:56Z"
      message: |-
        Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
          NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483
      reason: EvaluationFailed
      status: Unknown
      type: Recommended
    release:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:92bbf82553fe2b2e52bf3263364e8506d7c1c4ba8c271c99f3c0f2fd6000e8b0
      url: https://access.redhat.com/errata/RHBA-2025:17662
      version: 4.19.16
    risks:
    - matchingRules:
      - promql:
          promql: |
            topk by (_id) (1,
              group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
              or on (_id)
              0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
            )
            * on (_id) group_left (name)
            (
              group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
              or on (_id)
              group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
              or on (_id)
              0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
              or on (_id)
              0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
            )
        type: PromQL
      message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
        updates, breaking Kubernetes access to those Nodes and wedging the update
        into the exposed release.
      name: NetworkManagerOVNBridgeMapping
      url: https://issues.redhat.com/browse/CORENET-6483
  - conditions:
    - lastTransitionTime: "2025-11-17T19:09:56Z"
      message: |-
        Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
          NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483

        Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
          OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
      reason: EvaluationFailed
      status: Unknown
      type: Recommended
    release:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:f2302a88ad5dfae2e3b975c771a6999d02e405a2e9dc97570f50c85ac9f0abfc
      url: https://access.redhat.com/errata/RHBA-2025:17237
      version: 4.19.15
    risks:
    - matchingRules:
      - promql:
          promql: |
            topk by (_id) (1,
              group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
              or on (_id)
              0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
            )
            * on (_id) group_left (name)
            (
              group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
              or on (_id)
              group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
              or on (_id)
              0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
              or on (_id)
              0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
            )
        type: PromQL
      message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
        updates, breaking Kubernetes access to those Nodes and wedging the update
        into the exposed release.
      name: NetworkManagerOVNBridgeMapping
      url: https://issues.redhat.com/browse/CORENET-6483
    - matchingRules:
      - promql:
          promql: |
            0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
            or
            group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
        type: PromQL
      message: Clusters with restrictive image policies may struggle with OS updates
        when the OS image is already on the local disk.
      name: OSUpdateFailureDueToImagePullPolicy
      url: https://issues.redhat.com/browse/MCO-1896
  - conditions:
    - lastTransitionTime: "2025-11-17T19:09:56Z"
      message: |-
        Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
          NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483

        Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
          OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
      reason: EvaluationFailed
      status: Unknown
      type: Recommended
    release:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:8a14c89a1ac9afc9d696a7c2996a7110b75b48ce1ad49526f744538ecb0530ce
      url: https://access.redhat.com/errata/RHBA-2025:16693
      version: 4.19.14
    risks:
    - matchingRules:
      - promql:
          promql: |
            topk by (_id) (1,
              group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
              or on (_id)
              0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
            )
            * on (_id) group_left (name)
            (
              group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
              or on (_id)
              group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
              or on (_id)
              0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
              or on (_id)
              0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
            )
        type: PromQL
      message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
        updates, breaking Kubernetes access to those Nodes and wedging the update
        into the exposed release.
      name: NetworkManagerOVNBridgeMapping
      url: https://issues.redhat.com/browse/CORENET-6483
    - matchingRules:
      - promql:
          promql: |
            0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
            or
            group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
        type: PromQL
      message: Clusters with restrictive image policies may struggle with OS updates
        when the OS image is already on the local disk.
      name: OSUpdateFailureDueToImagePullPolicy
      url: https://issues.redhat.com/browse/MCO-1896
  - conditions:
    - lastTransitionTime: "2025-11-17T19:09:56Z"
      message: |-
        Could not evaluate exposure to update risk MachineConfigNodesV1AlphaControlPlaneLabels (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          MachineConfigNodesV1AlphaControlPlaneLabels description: Standalone clusters born in 4.11 or earlier whose control-plane nodes lack the control-plane role may need that role added to update to the target release.
          MachineConfigNodesV1AlphaControlPlaneLabels URL: https://issues.redhat.com/browse/MCO-1890

        Could not evaluate exposure to update risk NetworkManagerOVNBridgeMapping (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          NetworkManagerOVNBridgeMapping description: On some clusters, the NetworkManager may delete ovs-ports on RHCOS updates, breaking Kubernetes access to those Nodes and wedging the update into the exposed release.
          NetworkManagerOVNBridgeMapping URL: https://issues.redhat.com/browse/CORENET-6483

        Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
          OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
      reason: EvaluationFailed
      status: Unknown
      type: Recommended
    release:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:a3f546e89872e9f363d491c665ebd68f2af1660f7df4e52507054b9a6f3d5b34
      url: https://access.redhat.com/errata/RHBA-2025:16148
      version: 4.19.13
    risks:
    - matchingRules:
      - promql:
          promql: |
            0 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="control-plane"})
            or on ()
            1 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="master"})
            or on ()
            0 * topk(1, count by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb"}))
        type: PromQL
      message: Standalone clusters born in 4.11 or earlier whose control-plane nodes
        lack the control-plane role may need that role added to update to the target
        release.
      name: MachineConfigNodesV1AlphaControlPlaneLabels
      url: https://issues.redhat.com/browse/MCO-1890
    - matchingRules:
      - promql:
          promql: |
            topk by (_id) (1,
              group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type=~"None|BareMetal|OpenStack|VSphere"})
              or on (_id)
              0 * group by (_id, type) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"})
            )
            * on (_id) group_left (name)
            (
              group by (_id, name) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name=~"kubevirt-hyperconverged-operator[.].*"})
              or on (_id)
              group by (_id, name) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb", name="ovn.bridge-mappings"} > 0)
              or on (_id)
              0 * label_replace(group by (_id) (csv_succeeded{_id="6f32121c-f131-42aa-a5b8-868084af93cb"} + on (_id) group_left () group by (_id) (kubernetes_nmstate_features_applied{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})), "name", "not hyperconverged", "", "")
              or on (_id)
              0 * label_replace(group by (_id) (cluster_infrastructure_provider{_id="6f32121c-f131-42aa-a5b8-868084af93cb",type!~"None|BareMetal|OpenStack|VSphere"}), "name", "not sure about hyperconverged or ovn.bridge-mappings, but the whole platform is safe", "", "")
            )
        type: PromQL
      message: On some clusters, the NetworkManager may delete ovs-ports on RHCOS
        updates, breaking Kubernetes access to those Nodes and wedging the update
        into the exposed release.
      name: NetworkManagerOVNBridgeMapping
      url: https://issues.redhat.com/browse/CORENET-6483
    - matchingRules:
      - promql:
          promql: |
            0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
            or
            group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
        type: PromQL
      message: Clusters with restrictive image policies may struggle with OS updates
        when the OS image is already on the local disk.
      name: OSUpdateFailureDueToImagePullPolicy
      url: https://issues.redhat.com/browse/MCO-1896
  - conditions:
    - lastTransitionTime: "2025-11-17T19:09:56Z"
      message: |-
        Could not evaluate exposure to update risk MachineConfigNodesV1AlphaControlPlaneLabels (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          MachineConfigNodesV1AlphaControlPlaneLabels description: Standalone clusters born in 4.11 or earlier whose control-plane nodes lack the control-plane role may need that role added to update to the target release.
          MachineConfigNodesV1AlphaControlPlaneLabels URL: https://issues.redhat.com/browse/MCO-1890

        Could not evaluate exposure to update risk OSUpdateFailureDueToImagePullPolicy (creating PromQL round-tripper: unable to read CA cert: unable to read file /etc/tls/service-ca/service-ca.crt: open /etc/tls/service-ca/service-ca.crt: no such file or directory)
          OSUpdateFailureDueToImagePullPolicy description: Clusters with restrictive image policies may struggle with OS updates when the OS image is already on the local disk.
          OSUpdateFailureDueToImagePullPolicy URL: https://issues.redhat.com/browse/MCO-1896
      reason: EvaluationFailed
      status: Unknown
      type: Recommended
    release:
      channels:
      - candidate-4.19
      - candidate-4.20
      - eus-4.20
      - fast-4.19
      - fast-4.20
      - stable-4.19
      - stable-4.20
      image: quay.io/openshift-release-dev/ocp-release@sha256:dbb7a2e2f7cd301ea24539fb03dfa716b905813c199e6b381ecad0a6006e9de4
      url: https://access.redhat.com/errata/RHBA-2025:15694
      version: 4.19.12
    risks:
    - matchingRules:
      - promql:
          promql: |
            0 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="control-plane"})
            or on ()
            1 * group by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb",role="master"})
            or on ()
            0 * topk(1, count by (role) (kube_node_role{_id="6f32121c-f131-42aa-a5b8-868084af93cb"}))
        type: PromQL
      message: Standalone clusters born in 4.11 or earlier whose control-plane nodes
        lack the control-plane role may need that role added to update to the target
        release.
      name: MachineConfigNodesV1AlphaControlPlaneLabels
      url: https://issues.redhat.com/browse/MCO-1890
    - matchingRules:
      - promql:
          promql: |
            0 * group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb",invoker="hypershift"})
            or
            group by (_id, invoker) (cluster_installer{_id="6f32121c-f131-42aa-a5b8-868084af93cb"})
        type: PromQL
      message: Clusters with restrictive image policies may struggle with OS updates
        when the OS image is already on the local disk.
      name: OSUpdateFailureDueToImagePullPolicy
      url: https://issues.redhat.com/browse/MCO-1896
  conditions:
  - lastTransitionTime: "2025-11-20T12:48:25Z"
    status: "True"
    type: RetrievedUpdates
  - lastTransitionTime: "2025-11-07T21:39:36Z"
    message: Capabilities match configured spec
    reason: AsExpected
    status: "False"
    type: ImplicitlyEnabledCapabilities
  - lastTransitionTime: "2025-11-07T21:39:36Z"
    message: Payload loaded version="4.19.10" image="quay.io/openshift-release-dev/ocp-release@sha256:00e31a4bb3131a9994810488352c9a7419bb90bebedc5fcc4daeb53a2fe7b408"
      architecture="Multi"
    reason: PayloadLoaded
    status: "True"
    type: ReleaseAccepted
  - lastTransitionTime: "2025-11-07T21:55:05Z"
    message: Done applying 4.19.10
    status: "True"
    type: Available
  - lastTransitionTime: "2025-11-07T21:55:05Z"
    status: "False"
    type: Failing
  - lastTransitionTime: "2025-11-07T21:55:05Z"
    message: Cluster version is 4.19.10
    status: "False"
    type: Progressing
  desired:
    channels:
    - candidate-4.19
    - candidate-4.20
    - eus-4.20
    - fast-4.19
    - fast-4.20
    - stable-4.19
    - stable-4.20
    image: quay.io/openshift-release-dev/ocp-release@sha256:00e31a4bb3131a9994810488352c9a7419bb90bebedc5fcc4daeb53a2fe7b408
    url: https://access.redhat.com/errata/RHBA-2025:14823
    version: 4.19.10
  history:
  - completionTime: "2025-11-07T21:55:05Z"
    image: quay.io/openshift-release-dev/ocp-release@sha256:00e31a4bb3131a9994810488352c9a7419bb90bebedc5fcc4daeb53a2fe7b408
    startedTime: "2025-11-07T21:39:36Z"
    state: Completed
    verified: false
    version: 4.19.10
  observedGeneration: 3
  versionHash: YWtntngAtFE=
