---
apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.37/23"],"mac_address":"0a:58:0a:86:00:25","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.37/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.37"
            ],
            "mac": "0a:58:0a:86:00:25",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:24:23Z"
    generateName: data-science-gateway-data-science-gateway-class-79f98cb86f-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: data-science-gateway-class
      gateway.networking.k8s.io/gateway-name: data-science-gateway
      pod-template-hash: 79f98cb86f
      service.istio.io/canonical-name: data-science-gateway-data-science-gateway-class
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-134-255
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"fd34c533-a2e7-4050-b9d4-b8fcce24df9d"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:24:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:24Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.37"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:26Z"
    name: data-science-gateway-data-science-gateway-class-79f98cb86f6j9q7
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: data-science-gateway-data-science-gateway-class-79f98cb86f
      uid: fd34c533-a2e7-4050-b9d4-b8fcce24df9d
    resourceVersion: "14673"
    uid: c5de1f7a-3665-4f3c-9f23-3febe52c88d0
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: data-science-gateway-data-science-gateway-class
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/data-science-gateway-data-science-gateway-class
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-n96jv
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: data-science-gateway-data-science-gateway-class-dockercfg-qq6xx
    nodeName: ip-10-0-134-255.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: data-science-gateway-data-science-gateway-class
    serviceAccountName: data-science-gateway-data-science-gateway-class
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-n96jv
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:25Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:23Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:26Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:26Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:23Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://335e5ca400ede68443c453ac28bb9a705b2a7f194acf096a7fefdcc9e15aa128
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:24:24Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-n96jv
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.134.255
    hostIPs:
    - ip: 10.0.134.255
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.37
    podIPs:
    - ip: 10.134.0.37
    qosClass: Burstable
    startTime: "2026-10-31T03:24:23Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.107/23"],"mac_address":"0a:58:0a:86:00:6b","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.107/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.107"
            ],
            "mac": "0a:58:0a:86:00:6b",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/port: "15014"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
      sidecar.istio.io/inject: "false"
    creationTimestamp: "2026-10-31T03:41:28Z"
    generateName: istiod-openshift-gateway-7ddd9cfdc8-
    generation: 1
    labels:
      app: istiod
      app.kubernetes.io/instance: openshift-gateway-istiod
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: istiod
      app.kubernetes.io/part-of: istio
      app.kubernetes.io/version: 1.28.10
      helm.sh/chart: istiod-1.28.10
      istio: istiod
      istio.io/dataplane-mode: none
      istio.io/rev: openshift-gateway
      operator.istio.io/component: Pilot
      pod-template-hash: 7ddd9cfdc8
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-134-255
      operation: Update
      subresource: status
      time: "2026-10-31T03:41:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
            f:sidecar.istio.io/inject: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
            f:istio: {}
            f:istio.io/dataplane-mode: {}
            f:istio.io/rev: {}
            f:operator.istio.io/component: {}
            f:pod-template-hash: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"67bae95b-ad60-4f8d-a680-c23055555375"}: {}
        f:spec:
          f:containers:
            k:{"name":"discovery"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_TRUSTED_NODE_ACCOUNTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ENABLE_GATEWAY_API_INFERENCE_EXTENSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"KUBECONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CA_CERT_CONFIGMAP"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_ALPHA_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_ANALYSIS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_STATUS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_GATEWAY_API_CONTROLLER_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_TRACE_SAMPLING"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PLATFORM"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"REVISION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"X_PILOT_IGNORE_RESOURCES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"X_PILOT_INCLUDE_RESOURCES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":8080,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15010,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15012,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15014,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15017,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
                f:runAsNonRoot: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/cacerts"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/istio-dns"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istiod/ca"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/istiod/tls"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/remote"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:volumes:
            .: {}
            k:{"name":"cacerts"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-csr-ca-configmap"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"istio-csr-dns-cert"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-kubeconfig"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"local-certs"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:41:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:41:29Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.107"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:41:38Z"
    name: istiod-openshift-gateway-7ddd9cfdc8-cx854
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: istiod-openshift-gateway-7ddd9cfdc8
      uid: 67bae95b-ad60-4f8d-a680-c23055555375
    resourceVersion: "44192"
    uid: 70b3d31c-a1ec-45db-97e5-cf9d1a0f227c
  spec:
    containers:
    - args:
      - discovery
      - --monitoringAddr=:15014
      - --log_output_level=default:info
      - --domain
      - cluster.local
      - --keepaliveMaxServerConnectionAge
      - 30m
      env:
      - name: REVISION
        value: openshift-gateway
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: KUBECONFIG
        value: /var/run/secrets/remote/config
      - name: CA_TRUSTED_NODE_ACCOUNTS
        value: kube-system/ztunnel
      - name: ENABLE_GATEWAY_API_INFERENCE_EXTENSION
        value: "true"
      - name: ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
        value: "false"
      - name: PILOT_ENABLE_ALPHA_GATEWAY_API
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API_STATUS
        value: "true"
      - name: PILOT_GATEWAY_API_CONTROLLER_NAME
        value: openshift.io/gateway-controller/v1
      - name: PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME
        value: openshift-default
      - name: PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API
        value: "false"
      - name: X_PILOT_IGNORE_RESOURCES
        value: '*.istio.io'
      - name: X_PILOT_INCLUDE_RESOURCES
        value: wasmplugins.extensions.istio.io,envoyfilters.networking.istio.io,destinationrules.networking.istio.io
      - name: PILOT_TRACE_SAMPLING
        value: "1"
      - name: PILOT_CA_CERT_CONFIGMAP
        value: openshift-gw-ca-root-cert
      - name: PILOT_ENABLE_ANALYSIS
        value: "false"
      - name: CLUSTER_ID
        value: Kubernetes
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "1"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "1"
            resource: limits.cpu
      - name: PLATFORM
        value: openshift
      image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:d5adf3101d4e14c710cd05afb3fa53498e3c5fb31a120f1bb007fba2e3b376f8
      imagePullPolicy: IfNotPresent
      name: discovery
      ports:
      - containerPort: 8080
        name: http-debug
        protocol: TCP
      - containerPort: 15010
        name: grpc-xds
        protocol: TCP
      - containerPort: 15012
        name: tls-xds
        protocol: TCP
      - containerPort: 15017
        name: https-webhooks
        protocol: TCP
      - containerPort: 15014
        name: http-monitoring
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /ready
          port: 8080
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 3
        successThreshold: 1
        timeoutSeconds: 5
      resources:
        requests:
          cpu: 500m
          memory: 2Gi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000430000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/tokens
        name: istio-token
        readOnly: true
      - mountPath: /var/run/secrets/istio-dns
        name: local-certs
      - mountPath: /etc/cacerts
        name: cacerts
        readOnly: true
      - mountPath: /var/run/secrets/remote
        name: istio-kubeconfig
        readOnly: true
      - mountPath: /var/run/secrets/istiod/tls
        name: istio-csr-dns-cert
        readOnly: true
      - mountPath: /var/run/secrets/istiod/ca
        name: istio-csr-ca-configmap
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-pqtfx
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: istiod-openshift-gateway-dockercfg-476rz
    nodeName: ip-10-0-134-255.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 2000000000
    priorityClassName: system-cluster-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: istiod-openshift-gateway
    serviceAccountName: istiod-openshift-gateway
    terminationGracePeriodSeconds: 30
    tolerations:
    - key: cni.istio.io/not-ready
      operator: Exists
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir:
        medium: Memory
      name: local-certs
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - name: cacerts
      secret:
        defaultMode: 420
        optional: true
        secretName: cacerts
    - name: istio-kubeconfig
      secret:
        defaultMode: 420
        optional: true
        secretName: istio-kubeconfig
    - name: istio-csr-dns-cert
      secret:
        defaultMode: 420
        optional: true
        secretName: istiod-tls
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
        optional: true
      name: istio-csr-ca-configmap
    - name: kube-api-access-pqtfx
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:41:34Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:41:28Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:41:38Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:41:38Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:41:28Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 2Gi
      containerID: cri-o://53c0cdc45826269897fa8b540823745a429c4740640a7b37ef9053dcaf4b9309
      image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:d5adf3101d4e14c710cd05afb3fa53498e3c5fb31a120f1bb007fba2e3b376f8
      imageID: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:78b8134d45567565eb0eb365042b3c43414fed25e8d1b4b40d3029e864d9f72b
      lastState: {}
      name: discovery
      ready: true
      resources:
        requests:
          cpu: 500m
          memory: 2Gi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:41:34Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000430000
          uid: 1000430000
      volumeMounts:
      - mountPath: /var/run/secrets/tokens
        name: istio-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istio-dns
        name: local-certs
      - mountPath: /etc/cacerts
        name: cacerts
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/remote
        name: istio-kubeconfig
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istiod/tls
        name: istio-csr-dns-cert
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istiod/ca
        name: istio-csr-ca-configmap
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-pqtfx
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.134.255
    hostIPs:
    - ip: 10.0.134.255
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.107
    podIPs:
    - ip: 10.134.0.107
    qosClass: Burstable
    startTime: "2026-10-31T03:41:28Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.21/23"],"mac_address":"0a:58:0a:85:00:15","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.21/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.21"
            ],
            "mac": "0a:58:0a:85:00:15",
            "default": true,
            "dns": {}
        }]
      opendatahub.io/secret-hash: 133a3013c92c6c773faa3eb2ae7ce9bb7f639061949ba11f882144da1a1eb6e6
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:24:23Z"
    generateName: kube-auth-proxy-764498d796-
    generation: 1
    labels:
      app: kube-auth-proxy
      app.kubernetes.io/component: authentication
      pod-template-hash: 764498d796
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-143-24
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:opendatahub.io/secret-hash: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"d93130ba-81fb-4bb0-b05f-16123e734f7b"}: {}
        f:spec:
          f:containers:
            k:{"name":"kube-auth-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_ID"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_COOKIE_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":4180,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":8443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9000,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/tmp"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"tls-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"tmp"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
                f:sizeLimit: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:24:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:24Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.21"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:28Z"
    name: kube-auth-proxy-764498d796-5l9zv
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: kube-auth-proxy-764498d796
      uid: d93130ba-81fb-4bb0-b05f-16123e734f7b
    resourceVersion: "14808"
    uid: f4ac29c7-2389-44ce-90af-a241e3e98271
  spec:
    containers:
    - args:
      - --http-address=0.0.0.0:4180
      - --https-address=0.0.0.0:8443
      - --metrics-address=0.0.0.0:9000
      - --email-domain=*
      - --upstream=static://200
      - --skip-provider-button
      - --skip-jwt-bearer-tokens=true
      - --pass-access-token=true
      - --set-xauthrequest=true
      - --enable-k8s-token-validation=true
      - --redirect-url=https://rh-ai.apps.be4b409a817818413972.prod.konflux-ocp-ci.dev/oauth2/callback
      - --tls-cert-file=/etc/tls/private/tls.crt
      - --tls-key-file=/etc/tls/private/tls.key
      - --tls-min-version=TLS1.2
      - --tls-cipher-suite=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
      - --use-system-trust-store=true
      - --cookie-expire=24h0m0s
      - --cookie-refresh=1h0m0s
      - --cookie-secure=true
      - --cookie-httponly=true
      - --cookie-samesite=lax
      - --cookie-name=_oauth2_proxy
      - --cookie-domain=rh-ai.apps.be4b409a817818413972.prod.konflux-ocp-ci.dev
      - --provider=openshift
      - --ssl-insecure-skip-verify=false
      - --scope=user:full
      env:
      - name: OAUTH2_PROXY_CLIENT_ID
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_ID
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_SECRET
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_COOKIE_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_COOKIE_SECRET
            name: kube-auth-proxy-creds
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imagePullPolicy: IfNotPresent
      name: kube-auth-proxy
      ports:
      - containerPort: 4180
        name: http
        protocol: TCP
      - containerPort: 8443
        name: https
        protocol: TCP
      - containerPort: 9000
        name: metrics
        protocol: TCP
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000430000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-mdcb6
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: kube-auth-proxy-dockercfg-cxr2k
    nodeName: ip-10-0-143-24.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: kube-auth-proxy
    serviceAccountName: kube-auth-proxy
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: tls-certs
      secret:
        defaultMode: 420
        secretName: kube-auth-proxy-tls
    - emptyDir:
        medium: Memory
        sizeLimit: 10Mi
      name: tmp
    - name: kube-api-access-mdcb6
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:23Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:28Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:28Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:23Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 128Mi
      containerID: cri-o://e22f4d4b8a6f4499984c8a5437736e8928aa24aae3915f53ff1e9636198691fc
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imageID: quay.io/opendatahub/odh-kube-auth-proxy@sha256:784e47ce6cbf2b41d23eb6009482ba6bf8503d4c77aae491aa813cade5626851
      lastState: {}
      name: kube-auth-proxy
      ready: true
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:24:27Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000430000
          uid: 1000430000
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-mdcb6
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.143.24
    hostIPs:
    - ip: 10.0.143.24
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.21
    podIPs:
    - ip: 10.133.0.21
    qosClass: Burstable
    startTime: "2026-10-31T03:24:23Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.27/23"],"mac_address":"0a:58:0a:84:00:1b","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.27/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.27"
            ],
            "mac": "0a:58:0a:84:00:1b",
            "default": true,
            "dns": {}
        }]
      opendatahub.io/secret-hash: 133a3013c92c6c773faa3eb2ae7ce9bb7f639061949ba11f882144da1a1eb6e6
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:24:23Z"
    generateName: kube-auth-proxy-764498d796-
    generation: 1
    labels:
      app: kube-auth-proxy
      app.kubernetes.io/component: authentication
      pod-template-hash: 764498d796
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-238
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:opendatahub.io/secret-hash: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"d93130ba-81fb-4bb0-b05f-16123e734f7b"}: {}
        f:spec:
          f:containers:
            k:{"name":"kube-auth-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_ID"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_COOKIE_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":4180,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":8443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9000,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/tmp"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"tls-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"tmp"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
                f:sizeLimit: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:24:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:24Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.27"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:24:28Z"
    name: kube-auth-proxy-764498d796-fmmn5
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: kube-auth-proxy-764498d796
      uid: d93130ba-81fb-4bb0-b05f-16123e734f7b
    resourceVersion: "14787"
    uid: 8f03c061-d61a-4f36-9a03-4bdd462df099
  spec:
    containers:
    - args:
      - --http-address=0.0.0.0:4180
      - --https-address=0.0.0.0:8443
      - --metrics-address=0.0.0.0:9000
      - --email-domain=*
      - --upstream=static://200
      - --skip-provider-button
      - --skip-jwt-bearer-tokens=true
      - --pass-access-token=true
      - --set-xauthrequest=true
      - --enable-k8s-token-validation=true
      - --redirect-url=https://rh-ai.apps.be4b409a817818413972.prod.konflux-ocp-ci.dev/oauth2/callback
      - --tls-cert-file=/etc/tls/private/tls.crt
      - --tls-key-file=/etc/tls/private/tls.key
      - --tls-min-version=TLS1.2
      - --tls-cipher-suite=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
      - --use-system-trust-store=true
      - --cookie-expire=24h0m0s
      - --cookie-refresh=1h0m0s
      - --cookie-secure=true
      - --cookie-httponly=true
      - --cookie-samesite=lax
      - --cookie-name=_oauth2_proxy
      - --cookie-domain=rh-ai.apps.be4b409a817818413972.prod.konflux-ocp-ci.dev
      - --provider=openshift
      - --ssl-insecure-skip-verify=false
      - --scope=user:full
      env:
      - name: OAUTH2_PROXY_CLIENT_ID
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_ID
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_SECRET
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_COOKIE_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_COOKIE_SECRET
            name: kube-auth-proxy-creds
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imagePullPolicy: IfNotPresent
      name: kube-auth-proxy
      ports:
      - containerPort: 4180
        name: http
        protocol: TCP
      - containerPort: 8443
        name: https
        protocol: TCP
      - containerPort: 9000
        name: metrics
        protocol: TCP
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000430000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-npcv2
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: kube-auth-proxy-dockercfg-cxr2k
    nodeName: ip-10-0-138-238.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: kube-auth-proxy
    serviceAccountName: kube-auth-proxy
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: tls-certs
      secret:
        defaultMode: 420
        secretName: kube-auth-proxy-tls
    - emptyDir:
        medium: Memory
        sizeLimit: 10Mi
      name: tmp
    - name: kube-api-access-npcv2
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:23Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:28Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:28Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:24:23Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 128Mi
      containerID: cri-o://81ab6312f2dcc8763722e39f3fc390a543912dd372fe179b909c388cacb3c34c
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imageID: quay.io/opendatahub/odh-kube-auth-proxy@sha256:784e47ce6cbf2b41d23eb6009482ba6bf8503d4c77aae491aa813cade5626851
      lastState: {}
      name: kube-auth-proxy
      ready: true
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:24:27Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000430000
          uid: 1000430000
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-npcv2
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.238
    hostIPs:
    - ip: 10.0.138.238
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.27
    podIPs:
    - ip: 10.132.0.27
    qosClass: Burstable
    startTime: "2026-10-31T03:24:23Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.143/23"],"mac_address":"0a:58:0a:85:00:8f","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.143/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.143"
            ],
            "mac": "0a:58:0a:85:00:8f",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:45:15Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-143-24
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:16Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.143"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:25Z"
    name: maas-default-gateway-openshift-default-fd4b99879-6d674
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "52728"
    uid: eaf69280-a762-4868-9057-76241c023adf
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-8tkww
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-143-24.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-8tkww
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:17Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:25Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:25Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://c2bed18b86580705a7c1234a5cd609ca115a07a42e612e472b4b72ba3eb5de0d
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:45:16Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-8tkww
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.143.24
    hostIPs:
    - ip: 10.0.143.24
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.143
    podIPs:
    - ip: 10.133.0.143
    qosClass: Burstable
    startTime: "2026-10-31T03:45:15Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.126/23"],"mac_address":"0a:58:0a:86:00:7e","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.126/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.126"
            ],
            "mac": "0a:58:0a:86:00:7e",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:45:15Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-134-255
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.126"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:25Z"
    name: maas-default-gateway-openshift-default-fd4b99879-dqwsm
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "52647"
    uid: 84553d7f-51d4-4b72-b2dd-ee522e5413ad
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-lgnb2
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-134-255.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-lgnb2
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:16Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:24Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:24Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://10e0612302964190acc4b45c12820ee8d41dd22d83aad074b90adce6a71cc6a2
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:45:16Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-lgnb2
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.134.255
    hostIPs:
    - ip: 10.0.134.255
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.126
    podIPs:
    - ip: 10.134.0.126
    qosClass: Burstable
    startTime: "2026-10-31T03:45:15Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.118/23"],"mac_address":"0a:58:0a:86:00:76","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.118/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.118"
            ],
            "mac": "0a:58:0a:86:00:76",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:43:00Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-134-255
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.118"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:09Z"
    name: maas-default-gateway-openshift-default-fd4b99879-jgmq4
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "48014"
    uid: 92da6b1c-2d25-4e59-b877-a9b3b265ab3f
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-stkfg
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-134-255.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-stkfg
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:01Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:00Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:09Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:09Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:00Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://50f76bf598c2240136b240c6cd1086068ccaf38535aa80f1693dcceec58e4451
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:43:01Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-stkfg
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.134.255
    hostIPs:
    - ip: 10.0.134.255
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.118
    podIPs:
    - ip: 10.134.0.118
    qosClass: Burstable
    startTime: "2026-10-31T03:43:00Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.76/23"],"mac_address":"0a:58:0a:84:00:4c","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.76/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.76"
            ],
            "mac": "0a:58:0a:84:00:4c",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:45:15Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-238
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.76"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:26Z"
    name: maas-default-gateway-openshift-default-fd4b99879-kll7s
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "52781"
    uid: a2e58daa-d4a4-45a5-b9ae-d7906f70c916
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-q6njz
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-138-238.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-q6njz
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:16Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:26Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:26Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://a15632786d17b39274c324b689b181a0a03fe7dfd35cda7945882ef330102dd9
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:45:16Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-q6njz
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.238
    hostIPs:
    - ip: 10.0.138.238
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.76
    podIPs:
    - ip: 10.132.0.76
    qosClass: Burstable
    startTime: "2026-10-31T03:45:15Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.127/23"],"mac_address":"0a:58:0a:85:00:7f","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.127/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.127"
            ],
            "mac": "0a:58:0a:85:00:7f",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:43:00Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-143-24
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.127"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:10Z"
    name: maas-default-gateway-openshift-default-fd4b99879-kqkqf
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "48059"
    uid: 1a068c85-58af-48e3-9fe0-55756d21fb67
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-2kw2l
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-143-24.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-2kw2l
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:01Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:00Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:10Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:10Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:00Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://463301f29b2b4858789d18e3d2e8f457d5a459873c9f1ca87b10cbe2f80ee40f
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:43:00Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-2kw2l
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.143.24
    hostIPs:
    - ip: 10.0.143.24
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.127
    podIPs:
    - ip: 10.133.0.127
    qosClass: Burstable
    startTime: "2026-10-31T03:43:00Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.133/23"],"mac_address":"0a:58:0a:86:00:85","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.133/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.133"
            ],
            "mac": "0a:58:0a:86:00:85",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:45:30Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-134-255
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:30Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:45:30Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:31Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.133"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:39Z"
    name: maas-default-gateway-openshift-default-fd4b99879-lcwvs
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "53423"
    uid: 3d7daa66-ba76-4d1a-9de8-2a68928f22b7
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zfsjr
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-134-255.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-zfsjr
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:32Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:30Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:39Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:39Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:30Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://0a63971e408ae6712ac263e2cc8e377a6c91501ccf9974bad9b31f76ada4e3fb
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:45:31Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zfsjr
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.134.255
    hostIPs:
    - ip: 10.0.134.255
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.133
    podIPs:
    - ip: 10.134.0.133
    qosClass: Burstable
    startTime: "2026-10-31T03:45:30Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.34/23"],"mac_address":"0a:58:0a:84:00:22","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.34/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.34"
            ],
            "mac": "0a:58:0a:84:00:22",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:28:59Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-238
      operation: Update
      subresource: status
      time: "2026-10-31T03:28:59Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:28:59Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.34"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:08Z"
    name: maas-default-gateway-openshift-default-fd4b99879-q9mpw
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "21268"
    uid: b9444d14-3d85-439f-a7ef-751d9fee021e
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-d9ndj
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-138-238.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-d9ndj
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:01Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:28:59Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:08Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:08Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:28:59Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://e5b4d888022ec36bc751bcf22d8de8c684a1fb6cf86dc74abfedd0be683c1e61
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:29:00Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-d9ndj
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.238
    hostIPs:
    - ip: 10.0.138.238
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.34
    podIPs:
    - ip: 10.132.0.34
    qosClass: Burstable
    startTime: "2026-10-31T03:28:59Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.75/23"],"mac_address":"0a:58:0a:84:00:4b","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.75/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.75"
            ],
            "mac": "0a:58:0a:84:00:4b",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:45:15Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-238
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:45:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:16Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.75"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:26Z"
    name: maas-default-gateway-openshift-default-fd4b99879-s5kcb
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "52818"
    uid: 5453941c-2d09-4ff9-aaaf-cc0e162876e0
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-mggxx
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-138-238.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-mggxx
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:16Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:26Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:26Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:15Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://02670fb60cb732e6bf6b1432220dbb41bed331f979d60272074ebf30d44b31a5
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:45:16Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-mggxx
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.238
    hostIPs:
    - ip: 10.0.138.238
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.75
    podIPs:
    - ip: 10.132.0.75
    qosClass: Burstable
    startTime: "2026-10-31T03:45:15Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.128/23"],"mac_address":"0a:58:0a:85:00:80","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.128/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.128"
            ],
            "mac": "0a:58:0a:85:00:80",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:43:00Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-143-24
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.128"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:43:10Z"
    name: maas-default-gateway-openshift-default-fd4b99879-xxm8g
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "48053"
    uid: ee63cc13-5d3f-4f87-a8f8-2c7987300722
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-42zms
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-143-24.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-42zms
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:01Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:00Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:10Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:10Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:43:00Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://01ded7354bed48118f64c32b84fb13c444d0ade40acb65455cb1971a837ff70a
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:43:01Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-42zms
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.143.24
    hostIPs:
    - ip: 10.0.143.24
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.128
    podIPs:
    - ip: 10.133.0.128
    qosClass: Burstable
    startTime: "2026-10-31T03:43:00Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.145/23"],"mac_address":"0a:58:0a:85:00:91","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.145/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.145"
            ],
            "mac": "0a:58:0a:85:00:91",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:45:30Z"
    generateName: maas-default-gateway-openshift-default-fd4b99879-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: fd4b99879
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-143-24
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:30Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1de33ed4-a459-4fa2-aa93-2919897dfcd8"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:45:30Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:31Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.145"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:45:39Z"
    name: maas-default-gateway-openshift-default-fd4b99879-znzrz
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-fd4b99879
      uid: 1de33ed4-a459-4fa2-aa93-2919897dfcd8
    resourceVersion: "53417"
    uid: 7f7842f2-5eeb-417d-8bcb-76f99f23fe23
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-xgnc9
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-4td2m
    nodeName: ip-10-0-143-24.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-xgnc9
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:31Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:30Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:39Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:39Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:45:30Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://d99880eb43adfbe0d9d32ff9991d9181b29bd7eb2fdeaa31cfb0c9028f19d459
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:45:31Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-xgnc9
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.143.24
    hostIPs:
    - ip: 10.0.143.24
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.145
    podIPs:
    - ip: 10.133.0.145
    qosClass: Burstable
    startTime: "2026-10-31T03:45:30Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.29/23"],"mac_address":"0a:58:0a:86:00:1d","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.29/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.29"
            ],
            "mac": "0a:58:0a:86:00:1d",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:23:26Z"
    generateName: openshift-ai-inference-openshift-ai-inference-666dbc6559-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-ai-inference
      gateway.networking.k8s.io/gateway-name: openshift-ai-inference
      pod-template-hash: 666dbc6559
      service.istio.io/canonical-name: openshift-ai-inference-openshift-ai-inference
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-134-255
      operation: Update
      subresource: status
      time: "2026-10-31T03:23:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"90254c03-9f82-49bd-8790-7581f9b16a19"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:23:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:23:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.29"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:23:37Z"
    name: openshift-ai-inference-openshift-ai-inference-666dbc6559-mnn8v
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: openshift-ai-inference-openshift-ai-inference-666dbc6559
      uid: 90254c03-9f82-49bd-8790-7581f9b16a19
    resourceVersion: "10165"
    uid: c539e6bf-2bd3-482c-9881-5c3fd79143e2
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: openshift-ai-inference-openshift-ai-inference
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/openshift-ai-inference-openshift-ai-inference
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000439999
        runAsNonRoot: true
        runAsUser: 1000439999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-9nql9
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: openshift-ai-inference-openshift-ai-inference-dockercfg-f2w6z
    nodeName: ip-10-0-134-255.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: openshift-ai-inference-openshift-ai-inference
    serviceAccountName: openshift-ai-inference-openshift-ai-inference
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-9nql9
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:23:35Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:23:26Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:23:37Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:23:37Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:23:26Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://30b9f0b429307637e18d310cafc0e79588f1dc56804f04b25518f4abe084c0d9
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:23:35Z"
      user:
        linux:
          gid: 1000439999
          supplementalGroups:
          - 1000439999
          - 1000430000
          uid: 1000439999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-9nql9
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.134.255
    hostIPs:
    - ip: 10.0.134.255
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.29
    podIPs:
    - ip: 10.134.0.29
    qosClass: Burstable
    startTime: "2026-10-31T03:23:26Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.30/23"],"mac_address":"0a:58:0a:85:00:1e","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.30/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.30"
            ],
            "mac": "0a:58:0a:85:00:1e",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:29:11Z"
    generateName: payload-pre-processing-7b98bb678c-
    generation: 1
    labels:
      app: payload-pre-processing
      app.kubernetes.io/managed-by: ai-gateway-controller
      maas.opendatahub.io/tenant-instance: payload-pre-processing
      pod-template-hash: 7b98bb678c
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-143-24
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/managed-by: {}
            f:maas.opendatahub.io/tenant-instance: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"28ef779a-ec79-410b-af47-b58cadd8e5d4"}: {}
        f:spec:
          f:containers:
            k:{"name":"payload-pre-processing"}:
              .: {}
              f:args: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:lifecycle:
                .: {}
                f:preStop:
                  .: {}
                  f:sleep:
                    .: {}
                    f:seconds: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9004,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":50052,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:grpc:
                  .: {}
                  f:port: {}
                  f:service: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
                f:runAsNonRoot: {}
                f:seccompProfile:
                  .: {}
                  f:type: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/praxis"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"plugins-config-volume"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:29:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.30"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:26Z"
    name: payload-pre-processing-7b98bb678c-zqpt2
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: payload-pre-processing-7b98bb678c
      uid: 28ef779a-ec79-410b-af47-b58cadd8e5d4
    resourceVersion: "21608"
    uid: f5ba0a01-b535-458e-b03b-63a5f48eeaeb
  spec:
    containers:
    - args:
      - -c
      - /etc/praxis/pre-extproc.yaml
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imagePullPolicy: IfNotPresent
      lifecycle:
        preStop:
          sleep:
            seconds: 5
      livenessProbe:
        failureThreshold: 3
        initialDelaySeconds: 15
        periodSeconds: 20
        successThreshold: 1
        tcpSocket:
          port: health
        timeoutSeconds: 1
      name: payload-pre-processing
      ports:
      - containerPort: 9004
        name: grpc
        protocol: TCP
      - containerPort: 50052
        name: health
        protocol: TCP
      - containerPort: 9090
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        grpc:
          port: 50052
          service: envoy.service.ext_proc.v3.ExternalProcessor
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: 200m
          memory: 128Mi
        requests:
          cpu: 25m
          memory: 32Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000430000
        seccompProfile:
          type: RuntimeDefault
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m45mw
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: payload-processing-dockercfg-mp6g4
    nodeName: ip-10-0-143-24.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: payload-processing
    serviceAccountName: payload-processing
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - configMap:
        defaultMode: 420
        name: payload-processing-plugins
      name: plugins-config-volume
    - name: kube-api-access-m45mw
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:15Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:11Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:26Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:26Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:11Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 25m
        memory: 32Mi
      containerID: cri-o://2e22a7d2545a88eedbc0069baf9623bce5c91646573e0a54ecb8838a49514fec
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imageID: quay.io/opendatahub/odh-praxis-extproc@sha256:1f0e3b76260234039aa76788d080adbbae794ceda96a90785cec17f29668c2a0
      lastState: {}
      name: payload-pre-processing
      ready: true
      resources:
        limits:
          cpu: 200m
          memory: 128Mi
        requests:
          cpu: 25m
          memory: 32Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:29:14Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000430000
          uid: 1000430000
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m45mw
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.143.24
    hostIPs:
    - ip: 10.0.143.24
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.30
    podIPs:
    - ip: 10.133.0.30
    qosClass: Burstable
    startTime: "2026-10-31T03:29:11Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      ai-gateway-controller.opendatahub.io/extproc-config-sha256: 99ace36d4344145336ff0f3775d60adc6a6a229dce78cfb8312208868aea25e9
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.61/23"],"mac_address":"0a:58:0a:86:00:3d","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.61/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.61"
            ],
            "mac": "0a:58:0a:86:00:3d",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-31T03:29:11Z"
    generateName: payload-processing-55fbbbf9dc-
    generation: 1
    labels:
      app: payload-processing
      app.kubernetes.io/managed-by: ai-gateway-controller
      maas.opendatahub.io/tenant-instance: payload-processing
      pod-template-hash: 55fbbbf9dc
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-134-255
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:ai-gateway-controller.opendatahub.io/extproc-config-sha256: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/managed-by: {}
            f:maas.opendatahub.io/tenant-instance: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"8c36f871-80e2-4bf7-8423-681daf8327a4"}: {}
        f:spec:
          f:containers:
            k:{"name":"payload-processing"}:
              .: {}
              f:args: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:lifecycle:
                .: {}
                f:preStop:
                  .: {}
                  f:sleep:
                    .: {}
                    f:seconds: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9004,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":50052,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:grpc:
                  .: {}
                  f:port: {}
                  f:service: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
                f:runAsNonRoot: {}
                f:seccompProfile:
                  .: {}
                  f:type: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/praxis"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"plugins-config-volume"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:29:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:12Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.61"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:29:25Z"
    name: payload-processing-55fbbbf9dc-2z9q8
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: payload-processing-55fbbbf9dc
      uid: 8c36f871-80e2-4bf7-8423-681daf8327a4
    resourceVersion: "21597"
    uid: 40e3764e-c5f1-4c75-b49e-13d815a622d2
  spec:
    containers:
    - args:
      - -c
      - /etc/praxis/extproc.yaml
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imagePullPolicy: IfNotPresent
      lifecycle:
        preStop:
          sleep:
            seconds: 5
      livenessProbe:
        failureThreshold: 3
        initialDelaySeconds: 15
        periodSeconds: 20
        successThreshold: 1
        tcpSocket:
          port: health
        timeoutSeconds: 1
      name: payload-processing
      ports:
      - containerPort: 9004
        name: grpc
        protocol: TCP
      - containerPort: 50052
        name: health
        protocol: TCP
      - containerPort: 9090
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        grpc:
          port: 50052
          service: envoy.service.ext_proc.v3.ExternalProcessor
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 64Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000430000
        seccompProfile:
          type: RuntimeDefault
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-fhjrw
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: payload-processing-dockercfg-mp6g4
    nodeName: ip-10-0-134-255.us-west-1.compute.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c21,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: payload-processing
    serviceAccountName: payload-processing
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - configMap:
        defaultMode: 420
        name: payload-processing-plugins
      name: plugins-config-volume
    - name: kube-api-access-fhjrw
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:14Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:11Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:25Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:25Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:29:11Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 50m
        memory: 64Mi
      containerID: cri-o://c6d4eb6fe4b24dde404041ff1f2c78a7a8e43331c6ab10f9847f95dbe49bbd3f
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imageID: quay.io/opendatahub/odh-praxis-extproc@sha256:1f0e3b76260234039aa76788d080adbbae794ceda96a90785cec17f29668c2a0
      lastState: {}
      name: payload-processing
      ready: true
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 64Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:29:14Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000430000
          uid: 1000430000
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-fhjrw
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.134.255
    hostIPs:
    - ip: 10.0.134.255
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.61
    podIPs:
    - ip: 10.134.0.61
    qosClass: Burstable
    startTime: "2026-10-31T03:29:11Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.20/23"],"mac_address":"0a:58:0a:84:00:14","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.20/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.20"
            ],
            "mac": "0a:58:0a:84:00:14",
            "default": true,
            "dns": {}
        }]
      openshift.io/required-scc: restricted
      openshift.io/scc: restricted
      security.openshift.io/validated-scc-subject-type: serviceaccount
    creationTimestamp: "2026-10-31T03:14:19Z"
    generateName: router-default-6d69c76ccf-
    generation: 1
    labels:
      ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
      ingresscontroller.operator.openshift.io/hash: 746b58fb
      pod-template-hash: 6d69c76ccf
      topology.kubernetes.io/region: us-west-1
      topology.kubernetes.io/zone: us-west-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:openshift.io/required-scc: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:ingresscontroller.operator.openshift.io/deployment-ingresscontroller: {}
            f:ingresscontroller.operator.openshift.io/hash: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"fd05d469-2991-444e-8e2e-5877fb5743b8"}: {}
        f:spec:
          f:affinity:
            .: {}
            f:nodeAffinity:
              .: {}
              f:requiredDuringSchedulingIgnoredDuringExecution: {}
          f:containers:
            k:{"name":"router"}:
              .: {}
              f:env:
                .: {}
                k:{"name":"DEFAULT_CERTIFICATE_DIR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"DEFAULT_DESTINATION_CA_PATH"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"RELOAD_INTERVAL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_ALLOW_WILDCARD_ROUTES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CANONICAL_HOSTNAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CIPHERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CIPHERSUITES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CURVES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DISABLE_HTTP2"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_ENABLE_EXTERNAL_CERTIFICATE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_LOAD_BALANCE_ALGORITHM"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_CERT_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_CIPHERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_KEY_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_MIN_VERSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TYPE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SERVICE_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SERVICE_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SET_FORWARDED_HEADERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_TCP_BALANCE_SCHEME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_THREADS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_USE_PROXY_PROTOCOL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SSL_MIN_VERSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_PASSWORD_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_PORT"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_USERNAME_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:terminationGracePeriodSeconds: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":80,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":1936,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:readOnlyRootFilesystem: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/pki/tls/metrics-certs"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/etc/pki/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/lib/haproxy/conf/metrics-auth"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/configmaps/service-ca"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:topologySpreadConstraints:
            .: {}
            k:{"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"ScheduleAnyway"}:
              .: {}
              f:labelSelector: {}
              f:maxSkew: {}
              f:topologyKey: {}
              f:whenUnsatisfiable: {}
          f:volumes:
            .: {}
            k:{"name":"default-certificate"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"metrics-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"service-ca-bundle"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:items: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"stats-auth"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-31T03:14:19Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            .: {}
            k:{"type":"PodScheduled"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:message: {}
              f:reason: {}
              f:status: {}
              f:type: {}
      manager: kube-scheduler
      operation: Update
      subresource: status
      time: "2026-10-31T03:18:51Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-238
      operation: Update
      subresource: status
      time: "2026-10-31T03:19:14Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-31T03:19:44Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.20"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-31T03:19:47Z"
    name: router-default-6d69c76ccf-dccpx
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: router-default-6d69c76ccf
      uid: fd05d469-2991-444e-8e2e-5877fb5743b8
    resourceVersion: "7149"
    uid: 7c86d4eb-4dbf-4daf-95a3-62d73fc5210b
  spec:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: node.openshift.io/remote-worker
              operator: NotIn
              values:
              - ""
    containers:
    - env:
      - name: DEFAULT_CERTIFICATE_DIR
        value: /etc/pki/tls/private
      - name: DEFAULT_DESTINATION_CA_PATH
        value: /var/run/configmaps/service-ca/service-ca.crt
      - name: RELOAD_INTERVAL
        value: 5s
      - name: ROUTER_ALLOW_WILDCARD_ROUTES
        value: "false"
      - name: ROUTER_CANONICAL_HOSTNAME
        value: router-default.apps.be4b409a817818413972.prod.konflux-ocp-ci.dev
      - name: ROUTER_CIPHERS
        value: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
      - name: ROUTER_CIPHERSUITES
        value: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
      - name: ROUTER_CURVES
        value: X25519MLKEM768:X25519:P-256:P-384:P-521
      - name: ROUTER_DISABLE_HTTP2
        value: "true"
      - name: ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK
        value: "false"
      - name: ROUTER_DOMAIN
        value: apps.be4b409a817818413972.prod.konflux-ocp-ci.dev
      - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE
        value: "true"
      - name: ROUTER_LOAD_BALANCE_ALGORITHM
        value: random
      - name: ROUTER_METRICS_TLS_CERT_FILE
        value: /etc/pki/tls/metrics-certs/tls.crt
      - name: ROUTER_METRICS_TLS_CIPHERS
        value: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
      - name: ROUTER_METRICS_TLS_KEY_FILE
        value: /etc/pki/tls/metrics-certs/tls.key
      - name: ROUTER_METRICS_TLS_MIN_VERSION
        value: VersionTLS12
      - name: ROUTER_METRICS_TYPE
        value: haproxy
      - name: ROUTER_SERVICE_NAME
        value: default
      - name: ROUTER_SERVICE_NAMESPACE
        value: openshift-ingress
      - name: ROUTER_SET_FORWARDED_HEADERS
        value: append
      - name: ROUTER_TCP_BALANCE_SCHEME
        value: source
      - name: ROUTER_THREADS
        value: "4"
      - name: ROUTER_USE_PROXY_PROTOCOL
        value: "true"
      - name: SSL_MIN_VERSION
        value: TLSv1.2
      - name: STATS_PASSWORD_FILE
        value: /var/lib/haproxy/conf/metrics-auth/statsPassword
      - name: STATS_PORT
        value: "1936"
      - name: STATS_USERNAME_FILE
        value: /var/lib/haproxy/conf/metrics-auth/statsUsername
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a679d80eb36ca7db888d4fbd1fdf16b0997a7c7a107936396b7a57d8b199f4e
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz
          port: 1936
          scheme: HTTP
        periodSeconds: 10
        successThreshold: 1
        terminationGracePeriodSeconds: 10
        timeoutSeconds: 1
      name: router
      ports:
      - containerPort: 80
        name: http
        protocol: TCP
      - containerPort: 443
        name: https
        protocol: TCP
      - containerPort: 1936
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz/ready
          port: 1936
          scheme: HTTP
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
      securityContext:
        allowPrivilegeEscalation: true
        capabilities:
          drop:
          - KILL
          - MKNOD
          - SETGID
          - SETUID
        readOnlyRootFilesystem: false
        runAsNonRoot: true
        runAsUser: 1000430000
      startupProbe:
        failureThreshold: 120
        httpGet:
          path: /healthz/ready
          port: 1936
          scheme: HTTP
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /etc/pki/tls/private
        name: default-certificate
        readOnly: true
      - mountPath: /var/run/configmaps/service-ca
        name: service-ca-bundle
        readOnly: true
      - mountPath: /var/lib/haproxy/conf/metrics-auth
        name: stats-auth
        readOnly: true
      - mountPath: /etc/pki/tls/metrics-certs
        name: metrics-certs
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-jmczk
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: router-dockercfg-7qxg9
    nodeName: ip-10-0-138-238.us-west-1.compute.internal
    nodeSelector:
      kubernetes.io/os: linux
      node-role.kubernetes.io/worker: ""
    preemptionPolicy: PreemptLowerPriority
    priority: 2000000000
    priorityClassName: system-cluster-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000430000
      seLinuxOptions:
        level: s0:c21,c5
    serviceAccount: router
    serviceAccountName: router
    terminationGracePeriodSeconds: 3600
    tolerations:
    - effect: NoExecute
      key: kubernetes.io/e2e-evict-taint-key
      operator: Equal
      value: evictTaintVal
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    topologySpreadConstraints:
    - labelSelector:
        matchExpressions:
        - key: ingresscontroller.operator.openshift.io/hash
          operator: In
          values:
          - 746b58fb
      maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: ScheduleAnyway
    volumes:
    - name: default-certificate
      secret:
        defaultMode: 420
        secretName: default-ingress-cert
    - configMap:
        defaultMode: 420
        items:
        - key: service-ca.crt
          path: service-ca.crt
        name: service-ca-bundle
        optional: false
      name: service-ca-bundle
    - name: stats-auth
      secret:
        defaultMode: 420
        secretName: router-stats-default
    - name: metrics-certs
      secret:
        defaultMode: 420
        secretName: router-metrics-certs-default
    - name: kube-api-access-jmczk
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:19:44Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:19:14Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:19:46Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:19:46Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-31T03:19:14Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 256Mi
      containerID: cri-o://455163807fbd412c2bfe7dc0ad7f5e95ed1bdee78da2309b227419afbf234739
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a679d80eb36ca7db888d4fbd1fdf16b0997a7c7a107936396b7a57d8b199f4e
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a679d80eb36ca7db888d4fbd1fdf16b0997a7c7a107936396b7a57d8b199f4e
      lastState: {}
      name: router
      ready: true
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-31T03:19:44Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000430000
          uid: 1000430000
      volumeMounts:
      - mountPath: /etc/pki/tls/private
        name: default-certificate
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/configmaps/service-ca
        name: service-ca-bundle
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/lib/haproxy/conf/metrics-auth
        name: stats-auth
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /etc/pki/tls/metrics-certs
        name: metrics-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-jmczk
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.238
    hostIPs:
    - ip: 10.0.138.238
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.20
    podIPs:
    - ip: 10.132.0.20
    qosClass: Burstable
    startTime: "2026-10-31T03:19:14Z"
kind: PodList
metadata:
  resourceVersion: "103467"