// Module included in the following assemblies:
//
// * windows_containers/wmco_rn/windows-containers-release-notes.adoc

:_mod-docs-content-type: CONCEPT
[id="windows-containers-release-notes-10-20-0_{context}"]
= Release notes for Red Hat Windows Machine Config Operator 10.20.0

Issued: 21 October 2025

// The components of the Red Hat Windows Machine Config Operator (WMCO) 10.20.0 were released in TBD.

[id="wmco-10-20-0-new-features"]
== New features and improvements

[id="wmco-10-20-0-new-features-kubernetes"]
=== Kubernetes upgrade

The WMCO now uses Kubernetes version 1.33.

[id="wmco-10-20-0-bug-fixes"]
== Bug fixes

* Previously, if you made a configuration change that required the WMCO to delete and recreate an internal config map, such as changing the proxy settings of the cluster, the WMCO pod panicked and entered a crash loop due to a nil pointer dereference panic. With this fix, the error handling logic is reworked. As a result, the WMCO pod no longer crashes when an internal config map is recreated. (link:https://issues.redhat.com/browse/OCPBUGS-60688[OCPBUGS-60688])

* Previously, during secret reconciliations, secret change data was being added to the logs on each reconciliation loop. As a result, this secret change data was persisting, causing the logs to grow in size with unrelated data. With this fix, only the current secret change data is being logged, reducing the size and complexity of the logs. (link:https://issues.redhat.com/browse/OCPBUGS-61559[OCPBUGS-61559])

* Previously, the `hybridOverlay` service was not using the trusted CA bundle when connecting to Kubernetes, because the `hybridOverlay` service command was missing the `--k8s-cacert` option. Because of this, users could encounter trust issues or failures when the `hybridOverlay` service attempted to communicate securely with Kubernetes clusters using custom or internal CAs. With this fix, the `hybridOverlay` service command now includes the `--k8s-cacert flag` pointing to the trusted CA bundle. As a result, the `hybridOverlay` service uses the trusted CA bundle for secure communication, preventing trust issues and ensuring compatibility with the cluster. 
// Hide until the Jira is set to Security: None. (link: //issues.redhat.com/browse/OCPBUGS-59637[OCPBUGS-59637])

* Previously, the WMCO neglected to close SSH connections when finishing node reconciliation. As a consequence, after adding a new Windows node to a cluster, the node SSH server eventually would refuse new connections due to being overwhelmed, causing node management issues. With this fix, the WMCO now properly closes SSH connections. As a result, the node SSH servers no longer refuse new connections due to this problem. (link:https://issues.redhat.com/browse/OCPBUGS-60482[OCPBUGS-60482])
