---
apiVersion: apps/v1
items:
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "2"
      meta.helm.sh/release-name: openshift-gateway-istiod
      meta.helm.sh/release-namespace: openshift-ingress
    creationTimestamp: "2026-03-18T16:55:10Z"
    generation: 1
    labels:
      app: istiod
      app.kubernetes.io/instance: openshift-gateway-istiod
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: istiod
      app.kubernetes.io/part-of: istio
      app.kubernetes.io/version: 1.26.2
      helm.sh/chart: istiod-1.26.2
      istio: istiod
      istio.io/dataplane-mode: none
      istio.io/rev: openshift-gateway
      operator.istio.io/component: Pilot
      pod-template-hash: 55ff986f96
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
            f:istio: {}
            f:istio.io/dataplane-mode: {}
            f:istio.io/rev: {}
            f:operator.istio.io/component: {}
            f:pod-template-hash: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1d598863-8315-4779-b2b1-f621597813d4"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:prometheus.io/port: {}
                f:prometheus.io/scrape: {}
                f:sidecar.istio.io/inject: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:app: {}
                f:app.kubernetes.io/instance: {}
                f:app.kubernetes.io/managed-by: {}
                f:app.kubernetes.io/name: {}
                f:app.kubernetes.io/part-of: {}
                f:app.kubernetes.io/version: {}
                f:helm.sh/chart: {}
                f:istio: {}
                f:istio.io/dataplane-mode: {}
                f:istio.io/rev: {}
                f:operator.istio.io/component: {}
                f:pod-template-hash: {}
                f:sidecar.istio.io/inject: {}
            f:spec:
              f:containers:
                k:{"name":"discovery"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"CA_TRUSTED_NODE_ACCOUNTS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"CLUSTER_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ENABLE_GATEWAY_API_INFERENCE_EXTENSION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GOMAXPROCS"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"GOMEMLIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"KUBECONFIG"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CERT_PROVIDER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ALPHA_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ANALYSIS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_STATUS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_CONTROLLER_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_TRACE_SAMPLING"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PLATFORM"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"REVISION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICE_ACCOUNT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8080,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15010,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15012,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15014,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15017,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsNonRoot: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/cacerts"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istio-dns"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/istiod/ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istiod/tls"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/remote"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/tokens"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
              f:dnsPolicy: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"cacerts"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-csr-ca-configmap"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"istio-csr-dns-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-kubeconfig"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-token"}:
                  .: {}
                  f:name: {}
                  f:projected:
                    .: {}
                    f:defaultMode: {}
                    f:sources: {}
                k:{"name":"local-certs"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-03-18T16:55:10Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-03-18T16:55:13Z"
    name: istiod-openshift-gateway-55ff986f96
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: istiod-openshift-gateway
      uid: 1d598863-8315-4779-b2b1-f621597813d4
    resourceVersion: "17121"
    uid: 5064cf35-ffd5-4175-9266-959305488667
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: istiod
        istio.io/rev: openshift-gateway
        pod-template-hash: 55ff986f96
    template:
      metadata:
        annotations:
          prometheus.io/port: "15014"
          prometheus.io/scrape: "true"
          sidecar.istio.io/inject: "false"
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          app: istiod
          app.kubernetes.io/instance: openshift-gateway-istiod
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: istiod
          app.kubernetes.io/part-of: istio
          app.kubernetes.io/version: 1.26.2
          helm.sh/chart: istiod-1.26.2
          istio: istiod
          istio.io/dataplane-mode: none
          istio.io/rev: openshift-gateway
          operator.istio.io/component: Pilot
          pod-template-hash: 55ff986f96
          sidecar.istio.io/inject: "false"
      spec:
        containers:
        - args:
          - discovery
          - --monitoringAddr=:15014
          - --log_output_level=default:info
          - --domain
          - cluster.local
          - --keepaliveMaxServerConnectionAge
          - 30m
          env:
          - name: REVISION
            value: openshift-gateway
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: KUBECONFIG
            value: /var/run/secrets/remote/config
          - name: CA_TRUSTED_NODE_ACCOUNTS
            value: kube-system/ztunnel
          - name: ENABLE_GATEWAY_API_INFERENCE_EXTENSION
            value: "true"
          - name: ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
            value: "false"
          - name: PILOT_ENABLE_ALPHA_GATEWAY_API
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_STATUS
            value: "true"
          - name: PILOT_GATEWAY_API_CONTROLLER_NAME
            value: openshift.io/gateway-controller/v1
          - name: PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME
            value: openshift-default
          - name: PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API
            value: "false"
          - name: PILOT_TRACE_SAMPLING
            value: "1"
          - name: PILOT_ENABLE_ANALYSIS
            value: "false"
          - name: CLUSTER_ID
            value: Kubernetes
          - name: GOMEMLIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.memory
          - name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.cpu
          - name: PLATFORM
            value: openshift
          image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:028e10651db0d1ddb769a27c9483c6d41be6ac597f253afd9d599f395d9c82d8
          imagePullPolicy: IfNotPresent
          name: discovery
          ports:
          - containerPort: 8080
            name: http-debug
            protocol: TCP
          - containerPort: 15010
            name: grpc-xds
            protocol: TCP
          - containerPort: 15012
            name: tls-xds
            protocol: TCP
          - containerPort: 15017
            name: https-webhooks
            protocol: TCP
          - containerPort: 15014
            name: http-monitoring
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 500m
              memory: 2Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/run/secrets/tokens
            name: istio-token
            readOnly: true
          - mountPath: /var/run/secrets/istio-dns
            name: local-certs
          - mountPath: /etc/cacerts
            name: cacerts
            readOnly: true
          - mountPath: /var/run/secrets/remote
            name: istio-kubeconfig
            readOnly: true
          - mountPath: /var/run/secrets/istiod/tls
            name: istio-csr-dns-cert
            readOnly: true
          - mountPath: /var/run/secrets/istiod/ca
            name: istio-csr-ca-configmap
            readOnly: true
        dnsPolicy: ClusterFirst
        priorityClassName: system-cluster-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: istiod-openshift-gateway
        serviceAccountName: istiod-openshift-gateway
        terminationGracePeriodSeconds: 30
        tolerations:
        - key: cni.istio.io/not-ready
          operator: Exists
        volumes:
        - emptyDir:
            medium: Memory
          name: local-certs
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: istio-ca
                expirationSeconds: 43200
                path: istio-token
        - name: cacerts
          secret:
            defaultMode: 420
            optional: true
            secretName: cacerts
        - name: istio-kubeconfig
          secret:
            defaultMode: 420
            optional: true
            secretName: istio-kubeconfig
        - name: istio-csr-dns-cert
          secret:
            defaultMode: 420
            optional: true
            secretName: istiod-tls
        - configMap:
            defaultMode: 420
            name: istio-ca-root-cert
            optional: true
          name: istio-csr-ca-configmap
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
      meta.helm.sh/release-name: openshift-gateway-istiod
      meta.helm.sh/release-namespace: openshift-ingress
    creationTimestamp: "2026-03-18T16:53:39Z"
    generation: 2
    labels:
      app: istiod
      app.kubernetes.io/instance: openshift-gateway-istiod
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: istiod
      app.kubernetes.io/part-of: istio
      app.kubernetes.io/version: 1.26.2
      helm.sh/chart: istiod-1.26.2
      istio: istiod
      istio.io/dataplane-mode: none
      istio.io/rev: openshift-gateway
      operator.istio.io/component: Pilot
      pod-template-hash: 7cd77c7ffd
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
            f:istio: {}
            f:istio.io/dataplane-mode: {}
            f:istio.io/rev: {}
            f:operator.istio.io/component: {}
            f:pod-template-hash: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1d598863-8315-4779-b2b1-f621597813d4"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:prometheus.io/port: {}
                f:prometheus.io/scrape: {}
                f:sidecar.istio.io/inject: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:app: {}
                f:app.kubernetes.io/instance: {}
                f:app.kubernetes.io/managed-by: {}
                f:app.kubernetes.io/name: {}
                f:app.kubernetes.io/part-of: {}
                f:app.kubernetes.io/version: {}
                f:helm.sh/chart: {}
                f:istio: {}
                f:istio.io/dataplane-mode: {}
                f:istio.io/rev: {}
                f:operator.istio.io/component: {}
                f:pod-template-hash: {}
                f:sidecar.istio.io/inject: {}
            f:spec:
              f:containers:
                k:{"name":"discovery"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"CA_TRUSTED_NODE_ACCOUNTS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"CLUSTER_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GOMAXPROCS"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"GOMEMLIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"KUBECONFIG"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CERT_PROVIDER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ALPHA_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ANALYSIS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_STATUS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_CONTROLLER_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_TRACE_SAMPLING"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PLATFORM"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"REVISION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICE_ACCOUNT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8080,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15010,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15012,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15014,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15017,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsNonRoot: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/cacerts"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istio-dns"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/istiod/ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istiod/tls"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/remote"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/tokens"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
              f:dnsPolicy: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"cacerts"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-csr-ca-configmap"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"istio-csr-dns-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-kubeconfig"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-token"}:
                  .: {}
                  f:name: {}
                  f:projected:
                    .: {}
                    f:defaultMode: {}
                    f:sources: {}
                k:{"name":"local-certs"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-03-18T16:55:13Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:observedGeneration: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-03-18T16:55:13Z"
    name: istiod-openshift-gateway-7cd77c7ffd
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: istiod-openshift-gateway
      uid: 1d598863-8315-4779-b2b1-f621597813d4
    resourceVersion: "17138"
    uid: 4ab3673f-f43c-450e-a254-cf941da3589e
  spec:
    replicas: 0
    selector:
      matchLabels:
        app: istiod
        istio.io/rev: openshift-gateway
        pod-template-hash: 7cd77c7ffd
    template:
      metadata:
        annotations:
          prometheus.io/port: "15014"
          prometheus.io/scrape: "true"
          sidecar.istio.io/inject: "false"
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          app: istiod
          app.kubernetes.io/instance: openshift-gateway-istiod
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: istiod
          app.kubernetes.io/part-of: istio
          app.kubernetes.io/version: 1.26.2
          helm.sh/chart: istiod-1.26.2
          istio: istiod
          istio.io/dataplane-mode: none
          istio.io/rev: openshift-gateway
          operator.istio.io/component: Pilot
          pod-template-hash: 7cd77c7ffd
          sidecar.istio.io/inject: "false"
      spec:
        containers:
        - args:
          - discovery
          - --monitoringAddr=:15014
          - --log_output_level=default:info
          - --domain
          - cluster.local
          - --keepaliveMaxServerConnectionAge
          - 30m
          env:
          - name: REVISION
            value: openshift-gateway
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: KUBECONFIG
            value: /var/run/secrets/remote/config
          - name: CA_TRUSTED_NODE_ACCOUNTS
            value: kube-system/ztunnel
          - name: ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
            value: "false"
          - name: PILOT_ENABLE_ALPHA_GATEWAY_API
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_STATUS
            value: "true"
          - name: PILOT_GATEWAY_API_CONTROLLER_NAME
            value: openshift.io/gateway-controller/v1
          - name: PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME
            value: openshift-default
          - name: PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API
            value: "false"
          - name: PILOT_TRACE_SAMPLING
            value: "1"
          - name: PILOT_ENABLE_ANALYSIS
            value: "false"
          - name: CLUSTER_ID
            value: Kubernetes
          - name: GOMEMLIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.memory
          - name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.cpu
          - name: PLATFORM
            value: openshift
          image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:028e10651db0d1ddb769a27c9483c6d41be6ac597f253afd9d599f395d9c82d8
          imagePullPolicy: IfNotPresent
          name: discovery
          ports:
          - containerPort: 8080
            name: http-debug
            protocol: TCP
          - containerPort: 15010
            name: grpc-xds
            protocol: TCP
          - containerPort: 15012
            name: tls-xds
            protocol: TCP
          - containerPort: 15017
            name: https-webhooks
            protocol: TCP
          - containerPort: 15014
            name: http-monitoring
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 500m
              memory: 2Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/run/secrets/tokens
            name: istio-token
            readOnly: true
          - mountPath: /var/run/secrets/istio-dns
            name: local-certs
          - mountPath: /etc/cacerts
            name: cacerts
            readOnly: true
          - mountPath: /var/run/secrets/remote
            name: istio-kubeconfig
            readOnly: true
          - mountPath: /var/run/secrets/istiod/tls
            name: istio-csr-dns-cert
            readOnly: true
          - mountPath: /var/run/secrets/istiod/ca
            name: istio-csr-ca-configmap
            readOnly: true
        dnsPolicy: ClusterFirst
        priorityClassName: system-cluster-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: istiod-openshift-gateway
        serviceAccountName: istiod-openshift-gateway
        terminationGracePeriodSeconds: 30
        tolerations:
        - key: cni.istio.io/not-ready
          operator: Exists
        volumes:
        - emptyDir:
            medium: Memory
          name: local-certs
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: istio-ca
                expirationSeconds: 43200
                path: istio-token
        - name: cacerts
          secret:
            defaultMode: 420
            optional: true
            secretName: cacerts
        - name: istio-kubeconfig
          secret:
            defaultMode: 420
            optional: true
            secretName: istio-kubeconfig
        - name: istio-csr-dns-cert
          secret:
            defaultMode: 420
            optional: true
            secretName: istiod-tls
        - configMap:
            defaultMode: 420
            name: istio-ca-root-cert
            optional: true
          name: istio-csr-ca-configmap
  status:
    observedGeneration: 2
    replicas: 0
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
    creationTimestamp: "2026-03-18T16:53:45Z"
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-name: openshift-ai-inference
      pod-template-hash: 7c5447bb76
      service.istio.io/canonical-name: openshift-ai-inference-openshift-default
      service.istio.io/canonical-revision: latest
      serving.kserve.io/gateway: kserve-ingress-gateway
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:serving.kserve.io/gateway: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"d625ef74-41a4-48f7-8816-23d3be96dfea"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:istio.io/rev: {}
                f:prometheus.io/path: {}
                f:prometheus.io/port: {}
                f:prometheus.io/scrape: {}
              f:labels:
                .: {}
                f:gateway.istio.io/managed: {}
                f:gateway.networking.k8s.io/gateway-name: {}
                f:pod-template-hash: {}
                f:service.istio.io/canonical-name: {}
                f:service.istio.io/canonical-revision: {}
                f:serving.kserve.io/gateway: {}
                f:sidecar.istio.io/inject: {}
            f:spec:
              f:containers:
                k:{"name":"istio-proxy"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"CA_ADDR"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GOMAXPROCS"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"GOMEMLIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"HOST_IP"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"INSTANCE_IP"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"ISTIO_CPU_LIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                      .: {}
                      f:name: {}
                    k:{"name":"ISTIO_META_CLUSTER_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_MESH_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_NODE_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"ISTIO_META_OWNER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_POD_PORTS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CERT_PROVIDER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"PROXY_CONFIG"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICE_ACCOUNT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"TRUST_DOMAIN"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":15020,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15021,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15090,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:limits:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsGroup: {}
                    f:runAsNonRoot: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/istio/pod"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/etc/istio/proxy"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/lib/istio/data"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/credential-uds"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/istio"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/tokens"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:dnsPolicy: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext:
                .: {}
                f:sysctls: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:volumes:
                .: {}
                k:{"name":"credential-socket"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"istio-data"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"istio-envoy"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                  f:name: {}
                k:{"name":"istio-podinfo"}:
                  .: {}
                  f:downwardAPI:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                  f:name: {}
                k:{"name":"istio-token"}:
                  .: {}
                  f:name: {}
                  f:projected:
                    .: {}
                    f:defaultMode: {}
                    f:sources: {}
                k:{"name":"istiod-ca-cert"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"workload-certs"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"workload-socket"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-03-18T16:53:45Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-03-18T16:53:50Z"
    name: openshift-ai-inference-openshift-default-7c5447bb76
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: openshift-ai-inference-openshift-default
      uid: d625ef74-41a4-48f7-8816-23d3be96dfea
    resourceVersion: "13275"
    uid: 3b7d6f00-35b2-4be8-bf5d-54f7b24c8a86
  spec:
    replicas: 1
    selector:
      matchLabels:
        gateway.networking.k8s.io/gateway-name: openshift-ai-inference
        pod-template-hash: 7c5447bb76
    template:
      metadata:
        annotations:
          istio.io/rev: openshift-gateway
          prometheus.io/path: /stats/prometheus
          prometheus.io/port: "15020"
          prometheus.io/scrape: "true"
        creationTimestamp: null
        labels:
          gateway.istio.io/managed: istio.io-gateway-controller
          gateway.networking.k8s.io/gateway-name: openshift-ai-inference
          pod-template-hash: 7c5447bb76
          service.istio.io/canonical-name: openshift-ai-inference-openshift-default
          service.istio.io/canonical-revision: latest
          serving.kserve.io/gateway: kserve-ingress-gateway
          sidecar.istio.io/inject: "false"
      spec:
        containers:
        - args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.cluster.local
          - --proxyLogLevel
          - warning
          - --proxyComponentLogLevel
          - misc:error
          - --log_output_level
          - default:info
          env:
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: CA_ADDR
            value: istiod-openshift-gateway.openshift-ingress.svc:15012
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: HOST_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.hostIP
          - name: ISTIO_CPU_LIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.cpu
          - name: PROXY_CONFIG
            value: |
              {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
          - name: ISTIO_META_POD_PORTS
            value: '[]'
          - name: ISTIO_META_APP_CONTAINERS
          - name: GOMEMLIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.memory
          - name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.cpu
          - name: ISTIO_META_CLUSTER_ID
            value: Kubernetes
          - name: ISTIO_META_NODE_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
          - name: ISTIO_META_INTERCEPTION_MODE
            value: REDIRECT
          - name: ISTIO_META_WORKLOAD_NAME
            value: openshift-ai-inference-openshift-default
          - name: ISTIO_META_OWNER
            value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/openshift-ai-inference-openshift-default
          - name: ISTIO_META_MESH_ID
            value: cluster.local
          - name: TRUST_DOMAIN
            value: cluster.local
          image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:d518f3d1539f45e1253c5c9fa22062802804601d4998cd50344e476a3cc388fe
          imagePullPolicy: IfNotPresent
          name: istio-proxy
          ports:
          - containerPort: 15020
            name: metrics
            protocol: TCP
          - containerPort: 15021
            name: status-port
            protocol: TCP
          - containerPort: 15090
            name: http-envoy-prom
            protocol: TCP
          readinessProbe:
            failureThreshold: 4
            httpGet:
              path: /healthz/ready
              port: 15021
              scheme: HTTP
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              cpu: "2"
              memory: 1Gi
            requests:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 1000319999
            runAsNonRoot: true
            runAsUser: 1000319999
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15021
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/run/secrets/workload-spiffe-uds
            name: workload-socket
          - mountPath: /var/run/secrets/credential-uds
            name: credential-socket
          - mountPath: /var/run/secrets/workload-spiffe-credentials
            name: workload-certs
          - mountPath: /var/run/secrets/istio
            name: istiod-ca-cert
          - mountPath: /var/lib/istio/data
            name: istio-data
          - mountPath: /etc/istio/proxy
            name: istio-envoy
          - mountPath: /var/run/secrets/tokens
            name: istio-token
          - mountPath: /etc/istio/pod
            name: istio-podinfo
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext:
          sysctls:
          - name: net.ipv4.ip_unprivileged_port_start
            value: "0"
        serviceAccount: openshift-ai-inference-openshift-default
        serviceAccountName: openshift-ai-inference-openshift-default
        terminationGracePeriodSeconds: 30
        volumes:
        - emptyDir: {}
          name: workload-socket
        - emptyDir: {}
          name: credential-socket
        - emptyDir: {}
          name: workload-certs
        - emptyDir:
            medium: Memory
          name: istio-envoy
        - emptyDir: {}
          name: istio-data
        - downwardAPI:
            defaultMode: 420
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.labels
              path: labels
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.annotations
              path: annotations
          name: istio-podinfo
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: istio-ca
                expirationSeconds: 43200
                path: istio-token
        - configMap:
            defaultMode: 420
            name: istio-ca-root-cert
          name: istiod-ca-cert
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
    creationTimestamp: "2026-03-18T16:40:43Z"
    generation: 1
    labels:
      ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
      ingresscontroller.operator.openshift.io/hash: 76d87cdbd9
      pod-template-hash: 559fbc86fb
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
          f:labels:
            .: {}
            f:ingresscontroller.operator.openshift.io/deployment-ingresscontroller: {}
            f:ingresscontroller.operator.openshift.io/hash: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"96cc2726-ca9a-473a-bd03-eeb14952f0b5"}: {}
        f:spec:
          f:minReadySeconds: {}
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:ingresscontroller.operator.openshift.io/deployment-ingresscontroller: {}
                f:ingresscontroller.operator.openshift.io/hash: {}
                f:pod-template-hash: {}
            f:spec:
              f:affinity:
                .: {}
                f:nodeAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"router"}:
                  .: {}
                  f:env:
                    .: {}
                    k:{"name":"DEFAULT_CERTIFICATE_DIR"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"DEFAULT_DESTINATION_CA_PATH"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"RELOAD_INTERVAL"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_ALLOW_WILDCARD_ROUTES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_CANONICAL_HOSTNAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_CIPHERS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_CIPHERSUITES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_DISABLE_HTTP2"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_DOMAIN"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_ENABLE_EXTERNAL_CERTIFICATE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_LOAD_BALANCE_ALGORITHM"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_METRICS_TLS_CERT_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_METRICS_TLS_KEY_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_METRICS_TYPE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_SERVICE_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_SERVICE_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_SET_FORWARDED_HEADERS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_TCP_BALANCE_SCHEME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_THREADS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_USE_PROXY_PROTOCOL"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SSL_MIN_VERSION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"STATS_PASSWORD_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"STATS_PORT"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"STATS_USERNAME_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:terminationGracePeriodSeconds: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":80,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":1936,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:readOnlyRootFilesystem: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/pki/tls/metrics-certs"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/etc/pki/tls/private"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/lib/haproxy/conf/metrics-auth"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/configmaps/service-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
              f:dnsPolicy: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:topologySpreadConstraints:
                .: {}
                k:{"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"ScheduleAnyway"}:
                  .: {}
                  f:labelSelector: {}
                  f:maxSkew: {}
                  f:topologyKey: {}
                  f:whenUnsatisfiable: {}
              f:volumes:
                .: {}
                k:{"name":"default-certificate"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"metrics-certs"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"service-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"stats-auth"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-03-18T16:40:43Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-03-18T16:47:49Z"
    name: router-default-559fbc86fb
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: router-default
      uid: 96cc2726-ca9a-473a-bd03-eeb14952f0b5
    resourceVersion: "8051"
    uid: b663e567-20b2-4eed-8b05-6c31813c12d7
  spec:
    minReadySeconds: 30
    replicas: 1
    selector:
      matchLabels:
        ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
        pod-template-hash: 559fbc86fb
    template:
      metadata:
        annotations:
          openshift.io/required-scc: restricted
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
          ingresscontroller.operator.openshift.io/hash: 76d87cdbd9
          pod-template-hash: 559fbc86fb
      spec:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: node.openshift.io/remote-worker
                  operator: NotIn
                  values:
                  - ""
        containers:
        - env:
          - name: DEFAULT_CERTIFICATE_DIR
            value: /etc/pki/tls/private
          - name: DEFAULT_DESTINATION_CA_PATH
            value: /var/run/configmaps/service-ca/service-ca.crt
          - name: RELOAD_INTERVAL
            value: 5s
          - name: ROUTER_ALLOW_WILDCARD_ROUTES
            value: "false"
          - name: ROUTER_CANONICAL_HOSTNAME
            value: router-default.apps.d4ffe491-62ce-4b70-ab77-28b62d75263f.prod.konfluxeaas.com
          - name: ROUTER_CIPHERS
            value: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
          - name: ROUTER_CIPHERSUITES
            value: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
          - name: ROUTER_DISABLE_HTTP2
            value: "true"
          - name: ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK
            value: "false"
          - name: ROUTER_DOMAIN
            value: apps.d4ffe491-62ce-4b70-ab77-28b62d75263f.prod.konfluxeaas.com
          - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE
            value: "true"
          - name: ROUTER_LOAD_BALANCE_ALGORITHM
            value: random
          - name: ROUTER_METRICS_TLS_CERT_FILE
            value: /etc/pki/tls/metrics-certs/tls.crt
          - name: ROUTER_METRICS_TLS_KEY_FILE
            value: /etc/pki/tls/metrics-certs/tls.key
          - name: ROUTER_METRICS_TYPE
            value: haproxy
          - name: ROUTER_SERVICE_NAME
            value: default
          - name: ROUTER_SERVICE_NAMESPACE
            value: openshift-ingress
          - name: ROUTER_SET_FORWARDED_HEADERS
            value: append
          - name: ROUTER_TCP_BALANCE_SCHEME
            value: source
          - name: ROUTER_THREADS
            value: "4"
          - name: ROUTER_USE_PROXY_PROTOCOL
            value: "true"
          - name: SSL_MIN_VERSION
            value: TLSv1.2
          - name: STATS_PASSWORD_FILE
            value: /var/lib/haproxy/conf/metrics-auth/statsPassword
          - name: STATS_PORT
            value: "1936"
          - name: STATS_USERNAME_FILE
            value: /var/lib/haproxy/conf/metrics-auth/statsUsername
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ce5935b86fb6e92713f31e23166028e56f491ef14d756d8deead5c1455e73537
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 1936
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            terminationGracePeriodSeconds: 10
            timeoutSeconds: 1
          name: router
          ports:
          - containerPort: 80
            name: http
            protocol: TCP
          - containerPort: 443
            name: https
            protocol: TCP
          - containerPort: 1936
            name: metrics
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz/ready
              port: 1936
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: true
            readOnlyRootFilesystem: false
          startupProbe:
            failureThreshold: 120
            httpGet:
              path: /healthz/ready
              port: 1936
              scheme: HTTP
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /etc/pki/tls/private
            name: default-certificate
            readOnly: true
          - mountPath: /var/run/configmaps/service-ca
            name: service-ca-bundle
            readOnly: true
          - mountPath: /var/lib/haproxy/conf/metrics-auth
            name: stats-auth
            readOnly: true
          - mountPath: /etc/pki/tls/metrics-certs
            name: metrics-certs
            readOnly: true
        dnsPolicy: ClusterFirst
        nodeSelector:
          kubernetes.io/os: linux
          node-role.kubernetes.io/worker: ""
        priorityClassName: system-cluster-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: router
        serviceAccountName: router
        terminationGracePeriodSeconds: 3600
        tolerations:
        - effect: NoExecute
          key: kubernetes.io/e2e-evict-taint-key
          operator: Equal
          value: evictTaintVal
        topologySpreadConstraints:
        - labelSelector:
            matchExpressions:
            - key: ingresscontroller.operator.openshift.io/hash
              operator: In
              values:
              - 76d87cdbd9
          maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
        volumes:
        - name: default-certificate
          secret:
            defaultMode: 420
            secretName: default-ingress-cert
        - configMap:
            defaultMode: 420
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: service-ca-bundle
            optional: false
          name: service-ca-bundle
        - name: stats-auth
          secret:
            defaultMode: 420
            secretName: router-stats-default
        - name: metrics-certs
          secret:
            defaultMode: 420
            secretName: router-metrics-certs-default
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
kind: ReplicaSetList
metadata:
  resourceVersion: "19490"