https://github.com/openshift/cluster-kube-apiserver-operator/pull/1013 has wired a random cert to make kube 1.20 work because it started to require the service account issuer and the associated signing cert to be set. The reason it didn't wire it directly is because the cert requires to be plumbed from the installer and it was blocking the rebase. This is the follow up to fix it.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.