---
apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.31/23"],"mac_address":"0a:58:0a:86:00:1f","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.31/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.31"
            ],
            "mac": "0a:58:0a:86:00:1f",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-06-13T05:33:50Z"
    generateName: data-science-gateway-data-science-gateway-class-5b556588bc-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-name: data-science-gateway
      pod-template-hash: 5b556588bc
      service.istio.io/canonical-name: data-science-gateway-data-science-gateway-class
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-220
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:50Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"2b95f106-21c0-4fb8-9fe6-b48144d99ab0"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:33:50Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:51Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.31"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:55Z"
    name: data-science-gateway-data-science-gateway-class-5b556588bc4nsln
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: data-science-gateway-data-science-gateway-class-5b556588bc
      uid: 2b95f106-21c0-4fb8-9fe6-b48144d99ab0
    resourceVersion: "17534"
    uid: 2d25f8e8-dbbf-465a-b335-e35267c855e0
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: data-science-gateway-data-science-gateway-class
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/data-science-gateway-data-science-gateway-class
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:40be785b9abecd641f3121855a066c0ea01aba66e1350f33d175f2351c54e371
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000329999
        runAsNonRoot: true
        runAsUser: 1000329999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-f2jc8
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: data-science-gateway-data-science-gateway-class-dockercfg-w84sw
    nodeName: ip-10-0-140-220.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      seLinuxOptions:
        level: s0:c18,c7
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: data-science-gateway-data-science-gateway-class
    serviceAccountName: data-science-gateway-data-science-gateway-class
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-f2jc8
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:54Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:50Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:55Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:55Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:50Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://f896ec61bb20661a2598983cba0ac71e053274acf5d90648481fba65ae16dd26
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:40be785b9abecd641f3121855a066c0ea01aba66e1350f33d175f2351c54e371
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:40be785b9abecd641f3121855a066c0ea01aba66e1350f33d175f2351c54e371
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:33:53Z"
      user:
        linux:
          gid: 1000329999
          supplementalGroups:
          - 1000329999
          - 1000320000
          uid: 1000329999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-f2jc8
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.220
    hostIPs:
    - ip: 10.0.140.220
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.31
    podIPs:
    - ip: 10.134.0.31
    qosClass: Burstable
    startTime: "2026-06-13T05:33:50Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.25/23"],"mac_address":"0a:58:0a:85:00:19","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.25/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.25"
            ],
            "mac": "0a:58:0a:85:00:19",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/port: "15014"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
      sidecar.istio.io/inject: "false"
    creationTimestamp: "2026-06-13T05:33:46Z"
    generateName: istiod-openshift-gateway-75c67f8887-
    generation: 1
    labels:
      app: istiod
      app.kubernetes.io/instance: openshift-gateway-istiod
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: istiod
      app.kubernetes.io/part-of: istio
      app.kubernetes.io/version: 1.27.3
      helm.sh/chart: istiod-1.27.3
      istio: istiod
      istio.io/dataplane-mode: none
      istio.io/rev: openshift-gateway
      operator.istio.io/component: Pilot
      pod-template-hash: 75c67f8887
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-130-198
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:46Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
            f:sidecar.istio.io/inject: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
            f:istio: {}
            f:istio.io/dataplane-mode: {}
            f:istio.io/rev: {}
            f:operator.istio.io/component: {}
            f:pod-template-hash: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"89d9c236-2517-47a5-8bbf-36adb0512ba6"}: {}
        f:spec:
          f:containers:
            k:{"name":"discovery"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_TRUSTED_NODE_ACCOUNTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ENABLE_GATEWAY_API_INFERENCE_EXTENSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"KUBECONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CA_CERT_CONFIGMAP"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_ALPHA_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_ANALYSIS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_STATUS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_GATEWAY_API_CONTROLLER_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_TRACE_SAMPLING"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PLATFORM"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"REVISION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":8080,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15010,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15012,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15014,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15017,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
                f:runAsNonRoot: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/cacerts"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/istio-dns"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istiod/ca"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/istiod/tls"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/remote"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:volumes:
            .: {}
            k:{"name":"cacerts"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-csr-ca-configmap"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"istio-csr-dns-cert"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-kubeconfig"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"local-certs"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:33:46Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:46Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.25"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:53Z"
    name: istiod-openshift-gateway-75c67f8887-2fq6x
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: istiod-openshift-gateway-75c67f8887
      uid: 89d9c236-2517-47a5-8bbf-36adb0512ba6
    resourceVersion: "17479"
    uid: 50adff34-e886-49c0-bb54-18e6b4a580bc
  spec:
    containers:
    - args:
      - discovery
      - --monitoringAddr=:15014
      - --log_output_level=default:info
      - --domain
      - cluster.local
      - --keepaliveMaxServerConnectionAge
      - 30m
      env:
      - name: REVISION
        value: openshift-gateway
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: KUBECONFIG
        value: /var/run/secrets/remote/config
      - name: CA_TRUSTED_NODE_ACCOUNTS
        value: kube-system/ztunnel
      - name: ENABLE_GATEWAY_API_INFERENCE_EXTENSION
        value: "true"
      - name: ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
        value: "false"
      - name: PILOT_ENABLE_ALPHA_GATEWAY_API
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API_STATUS
        value: "true"
      - name: PILOT_GATEWAY_API_CONTROLLER_NAME
        value: openshift.io/gateway-controller/v1
      - name: PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME
        value: openshift-default
      - name: PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API
        value: "false"
      - name: PILOT_TRACE_SAMPLING
        value: "1"
      - name: PILOT_CA_CERT_CONFIGMAP
        value: openshift-gw-ca-root-cert
      - name: PILOT_ENABLE_ANALYSIS
        value: "false"
      - name: CLUSTER_ID
        value: Kubernetes
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "1"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "1"
            resource: limits.cpu
      - name: PLATFORM
        value: openshift
      image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:f118bf81f44443fbdab23b689c97e9801eba8799c7af85228f914d8cd8afe6c0
      imagePullPolicy: IfNotPresent
      name: discovery
      ports:
      - containerPort: 8080
        name: http-debug
        protocol: TCP
      - containerPort: 15010
        name: grpc-xds
        protocol: TCP
      - containerPort: 15012
        name: tls-xds
        protocol: TCP
      - containerPort: 15017
        name: https-webhooks
        protocol: TCP
      - containerPort: 15014
        name: http-monitoring
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /ready
          port: 8080
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 3
        successThreshold: 1
        timeoutSeconds: 5
      resources:
        requests:
          cpu: 500m
          memory: 2Gi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000320000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/tokens
        name: istio-token
        readOnly: true
      - mountPath: /var/run/secrets/istio-dns
        name: local-certs
      - mountPath: /etc/cacerts
        name: cacerts
        readOnly: true
      - mountPath: /var/run/secrets/remote
        name: istio-kubeconfig
        readOnly: true
      - mountPath: /var/run/secrets/istiod/tls
        name: istio-csr-dns-cert
        readOnly: true
      - mountPath: /var/run/secrets/istiod/ca
        name: istio-csr-ca-configmap
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-68zxj
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: istiod-openshift-gateway-dockercfg-zqc4x
    nodeName: ip-10-0-130-198.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 2000000000
    priorityClassName: system-cluster-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      seLinuxOptions:
        level: s0:c18,c7
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: istiod-openshift-gateway
    serviceAccountName: istiod-openshift-gateway
    terminationGracePeriodSeconds: 30
    tolerations:
    - key: cni.istio.io/not-ready
      operator: Exists
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir:
        medium: Memory
      name: local-certs
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - name: cacerts
      secret:
        defaultMode: 420
        optional: true
        secretName: cacerts
    - name: istio-kubeconfig
      secret:
        defaultMode: 420
        optional: true
        secretName: istio-kubeconfig
    - name: istio-csr-dns-cert
      secret:
        defaultMode: 420
        optional: true
        secretName: istiod-tls
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
        optional: true
      name: istio-csr-ca-configmap
    - name: kube-api-access-68zxj
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:49Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:46Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:53Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:53Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:46Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 2Gi
      containerID: cri-o://0b7c97cc09efda5f21bf02f740235963c567404c448bec3b0afdb15181b84525
      image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:f118bf81f44443fbdab23b689c97e9801eba8799c7af85228f914d8cd8afe6c0
      imageID: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7a23f83201027f55574ec3c94ca64fa01dda52658d44dca313314b0c16d31c76
      lastState: {}
      name: discovery
      ready: true
      resources:
        requests:
          cpu: 500m
          memory: 2Gi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:33:49Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000320000
          uid: 1000320000
      volumeMounts:
      - mountPath: /var/run/secrets/tokens
        name: istio-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istio-dns
        name: local-certs
      - mountPath: /etc/cacerts
        name: cacerts
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/remote
        name: istio-kubeconfig
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istiod/tls
        name: istio-csr-dns-cert
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istiod/ca
        name: istio-csr-ca-configmap
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-68zxj
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.130.198
    hostIPs:
    - ip: 10.0.130.198
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.25
    podIPs:
    - ip: 10.133.0.25
    qosClass: Burstable
    startTime: "2026-06-13T05:33:46Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.16/23"],"mac_address":"0a:58:0a:85:00:10","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.16/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.16"
            ],
            "mac": "0a:58:0a:85:00:10",
            "default": true,
            "dns": {}
        }]
      opendatahub.io/secret-hash: 614dafea71df05006f8afc782440d65758758d72395039f8a56c2ba818895196
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-06-13T05:33:15Z"
    generateName: kube-auth-proxy-666d479cbf-
    generation: 1
    labels:
      app: kube-auth-proxy
      app.kubernetes.io/component: authentication
      pod-template-hash: 666d479cbf
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-130-198
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:opendatahub.io/secret-hash: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"c7806db9-edbe-47a1-b1c0-41be7b24996d"}: {}
        f:spec:
          f:containers:
            k:{"name":"kube-auth-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_ID"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_COOKIE_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"PROXY_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":4180,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":8443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9000,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/tmp"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"tls-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"tmp"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
                f:sizeLimit: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:33:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:16Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.16"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:21Z"
    name: kube-auth-proxy-666d479cbf-l55qg
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: kube-auth-proxy-666d479cbf
      uid: c7806db9-edbe-47a1-b1c0-41be7b24996d
    resourceVersion: "15727"
    uid: 29d8627a-90ab-4936-a4ed-6e67016c52de
  spec:
    containers:
    - args:
      - --http-address=0.0.0.0:4180
      - --https-address=0.0.0.0:8443
      - --metrics-address=0.0.0.0:9000
      - --email-domain=*
      - --upstream=static://200
      - --skip-provider-button
      - --skip-jwt-bearer-tokens=true
      - --pass-access-token=true
      - --set-xauthrequest=true
      - --enable-k8s-token-validation=true
      - --redirect-url=https://rh-ai.apps.c4ab367b-4c13-44ef-b768-9900faa78493.prod.konfluxeaas.com/oauth2/callback
      - --tls-cert-file=/etc/tls/private/tls.crt
      - --tls-key-file=/etc/tls/private/tls.key
      - --use-system-trust-store=true
      - --cookie-expire=24h0m0s
      - --cookie-refresh=1h0m0s
      - --cookie-secure=true
      - --cookie-httponly=true
      - --cookie-samesite=lax
      - --cookie-name=_oauth2_proxy
      - --cookie-domain=rh-ai.apps.c4ab367b-4c13-44ef-b768-9900faa78493.prod.konfluxeaas.com
      - --provider=openshift
      - --ssl-insecure-skip-verify=false
      - --scope=user:full
      env:
      - name: OAUTH2_PROXY_CLIENT_ID
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_ID
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_SECRET
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_COOKIE_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_COOKIE_SECRET
            name: kube-auth-proxy-creds
      - name: PROXY_MODE
        value: auth
      image: quay.io/opendatahub/odh-kube-auth-proxy:v3.5.0-ea.1
      imagePullPolicy: IfNotPresent
      name: kube-auth-proxy
      ports:
      - containerPort: 4180
        name: http
        protocol: TCP
      - containerPort: 8443
        name: https
        protocol: TCP
      - containerPort: 9000
        name: metrics
        protocol: TCP
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000320000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-d566l
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: kube-auth-proxy-dockercfg-tzh8z
    nodeName: ip-10-0-130-198.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c18,c7
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: kube-auth-proxy
    serviceAccountName: kube-auth-proxy
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: tls-certs
      secret:
        defaultMode: 420
        secretName: kube-auth-proxy-tls
    - emptyDir:
        medium: Memory
        sizeLimit: 10Mi
      name: tmp
    - name: kube-api-access-d566l
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:21Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:15Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:21Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:21Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:15Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 128Mi
      containerID: cri-o://54e4204c32ad934dc2ca2f25ef6cbec1542af89b78307bf89c37fd0e1ed57203
      image: quay.io/opendatahub/odh-kube-auth-proxy:v3.5.0-ea.1
      imageID: quay.io/opendatahub/odh-kube-auth-proxy@sha256:1631cec0a988d9d033508072303ef0fe7aec28270dc0942b9abedc7e0893b409
      lastState: {}
      name: kube-auth-proxy
      ready: true
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:33:20Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000320000
          uid: 1000320000
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-d566l
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.130.198
    hostIPs:
    - ip: 10.0.130.198
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.16
    podIPs:
    - ip: 10.133.0.16
    qosClass: Burstable
    startTime: "2026-06-13T05:33:15Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.29/23"],"mac_address":"0a:58:0a:84:00:1d","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.29/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.29"
            ],
            "mac": "0a:58:0a:84:00:1d",
            "default": true,
            "dns": {}
        }]
      opendatahub.io/secret-hash: 614dafea71df05006f8afc782440d65758758d72395039f8a56c2ba818895196
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-06-13T05:33:15Z"
    generateName: kube-auth-proxy-666d479cbf-
    generation: 1
    labels:
      app: kube-auth-proxy
      app.kubernetes.io/component: authentication
      pod-template-hash: 666d479cbf
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-93
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:opendatahub.io/secret-hash: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"c7806db9-edbe-47a1-b1c0-41be7b24996d"}: {}
        f:spec:
          f:containers:
            k:{"name":"kube-auth-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_ID"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_COOKIE_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"PROXY_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":4180,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":8443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9000,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/tmp"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"tls-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"tmp"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
                f:sizeLimit: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:33:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.29"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:33:19Z"
    name: kube-auth-proxy-666d479cbf-p48pd
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: kube-auth-proxy-666d479cbf
      uid: c7806db9-edbe-47a1-b1c0-41be7b24996d
    resourceVersion: "15687"
    uid: d58abdaa-382c-444f-8d27-f1de6793a2e8
  spec:
    containers:
    - args:
      - --http-address=0.0.0.0:4180
      - --https-address=0.0.0.0:8443
      - --metrics-address=0.0.0.0:9000
      - --email-domain=*
      - --upstream=static://200
      - --skip-provider-button
      - --skip-jwt-bearer-tokens=true
      - --pass-access-token=true
      - --set-xauthrequest=true
      - --enable-k8s-token-validation=true
      - --redirect-url=https://rh-ai.apps.c4ab367b-4c13-44ef-b768-9900faa78493.prod.konfluxeaas.com/oauth2/callback
      - --tls-cert-file=/etc/tls/private/tls.crt
      - --tls-key-file=/etc/tls/private/tls.key
      - --use-system-trust-store=true
      - --cookie-expire=24h0m0s
      - --cookie-refresh=1h0m0s
      - --cookie-secure=true
      - --cookie-httponly=true
      - --cookie-samesite=lax
      - --cookie-name=_oauth2_proxy
      - --cookie-domain=rh-ai.apps.c4ab367b-4c13-44ef-b768-9900faa78493.prod.konfluxeaas.com
      - --provider=openshift
      - --ssl-insecure-skip-verify=false
      - --scope=user:full
      env:
      - name: OAUTH2_PROXY_CLIENT_ID
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_ID
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_SECRET
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_COOKIE_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_COOKIE_SECRET
            name: kube-auth-proxy-creds
      - name: PROXY_MODE
        value: auth
      image: quay.io/opendatahub/odh-kube-auth-proxy:v3.5.0-ea.1
      imagePullPolicy: IfNotPresent
      name: kube-auth-proxy
      ports:
      - containerPort: 4180
        name: http
        protocol: TCP
      - containerPort: 8443
        name: https
        protocol: TCP
      - containerPort: 9000
        name: metrics
        protocol: TCP
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000320000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dph8b
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: kube-auth-proxy-dockercfg-tzh8z
    nodeName: ip-10-0-138-93.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c18,c7
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: kube-auth-proxy
    serviceAccountName: kube-auth-proxy
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: tls-certs
      secret:
        defaultMode: 420
        secretName: kube-auth-proxy-tls
    - emptyDir:
        medium: Memory
        sizeLimit: 10Mi
      name: tmp
    - name: kube-api-access-dph8b
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:19Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:15Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:19Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:19Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:33:15Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 128Mi
      containerID: cri-o://5fdfc64989e92f143ff8928d83446e48416f2e2ba6f8407124651e88ca3be492
      image: quay.io/opendatahub/odh-kube-auth-proxy:v3.5.0-ea.1
      imageID: quay.io/opendatahub/odh-kube-auth-proxy@sha256:1631cec0a988d9d033508072303ef0fe7aec28270dc0942b9abedc7e0893b409
      lastState: {}
      name: kube-auth-proxy
      ready: true
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:33:19Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000320000
          uid: 1000320000
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dph8b
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.93
    hostIPs:
    - ip: 10.0.138.93
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.29
    podIPs:
    - ip: 10.132.0.29
    qosClass: Burstable
    startTime: "2026-06-13T05:33:15Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.45/23"],"mac_address":"0a:58:0a:86:00:2d","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.45/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.45"
            ],
            "mac": "0a:58:0a:86:00:2d",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-06-13T05:35:50Z"
    generateName: maas-default-gateway-openshift-default-8559cd5744-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 8559cd5744
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-220
      operation: Update
      subresource: status
      time: "2026-06-13T05:35:50Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"0c0adfa4-4840-43a0-bd13-2cc54e47d0f4"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:35:50Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:35:51Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.45"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:38:20Z"
    name: maas-default-gateway-openshift-default-8559cd5744-kbjcr
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-8559cd5744
      uid: 0c0adfa4-4840-43a0-bd13-2cc54e47d0f4
    resourceVersion: "25283"
    uid: 9c9c91de-400d-4c4c-9aa2-5db6a0a30282
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:40be785b9abecd641f3121855a066c0ea01aba66e1350f33d175f2351c54e371
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000329999
        runAsNonRoot: true
        runAsUser: 1000329999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-vm5qc
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-48h9f
    nodeName: ip-10-0-140-220.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      seLinuxOptions:
        level: s0:c18,c7
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-vm5qc
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:35:51Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:35:50Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:20Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:20Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:35:50Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://3e10a9f48e718ee0fc4ed29596691536b39f9538c344ae35191feb48b4adb8d5
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:40be785b9abecd641f3121855a066c0ea01aba66e1350f33d175f2351c54e371
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:40be785b9abecd641f3121855a066c0ea01aba66e1350f33d175f2351c54e371
      lastState:
        terminated:
          containerID: cri-o://3e38b1a7825beec3efd09d93fed93fed3bd9e9d785d63e51edc117f1967b34ff
          exitCode: 0
          finishedAt: "2026-06-13T05:38:14Z"
          reason: Completed
          startedAt: "2026-06-13T05:35:51Z"
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 1
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:38:15Z"
      user:
        linux:
          gid: 1000329999
          supplementalGroups:
          - 1000329999
          - 1000320000
          uid: 1000329999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-vm5qc
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.220
    hostIPs:
    - ip: 10.0.140.220
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.45
    podIPs:
    - ip: 10.134.0.45
    qosClass: Burstable
    startTime: "2026-06-13T05:35:50Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.36/23"],"mac_address":"0a:58:0a:84:00:24","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.36/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.36"
            ],
            "mac": "0a:58:0a:84:00:24",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-06-13T05:38:06Z"
    generateName: payload-pre-processing-579785bc64-
    generation: 1
    labels:
      app: payload-pre-processing
      app.kubernetes.io/component: api
      app.kubernetes.io/name: maas-api
      app.kubernetes.io/part-of: models-as-a-service
      pod-template-hash: 579785bc64
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-93
      operation: Update
      subresource: status
      time: "2026-06-13T05:38:06Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"54684428-11d1-4d55-8743-9023637ab818"}: {}
        f:spec:
          f:containers:
            k:{"name":"payload-pre-processing"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"MODEL_TO_HEADER"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:configMapKeyRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9004,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:38:06Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:38:07Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.36"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:38:21Z"
    name: payload-pre-processing-579785bc64-cpsgr
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: payload-pre-processing-579785bc64
      uid: 54684428-11d1-4d55-8743-9023637ab818
    resourceVersion: "25312"
    uid: 472f6b13-7aee-40b1-a98b-b777d4303edb
  spec:
    containers:
    - args:
      - --streaming
      - --v
      - "3"
      - --plugin
      - $(MODEL_TO_HEADER)
      - --tracing=false
      env:
      - name: MODEL_TO_HEADER
        valueFrom:
          configMapKeyRef:
            key: model-to-header-plugin
            name: payload-processing-plugins
      image: quay.io/opendatahub/odh-ai-gateway-payload-processing:36614760abfa1b3fb2b521a89097bdaf6e0693b5
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 3
        initialDelaySeconds: 15
        periodSeconds: 20
        successThreshold: 1
        tcpSocket:
          port: grpc
        timeoutSeconds: 1
      name: payload-pre-processing
      ports:
      - containerPort: 9004
        name: grpc
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1
        tcpSocket:
          port: grpc
        timeoutSeconds: 1
      resources:
        limits:
          cpu: 200m
          memory: 128Mi
        requests:
          cpu: 25m
          memory: 32Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000320000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-nfgcc
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    nodeName: ip-10-0-138-93.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c18,c7
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: payload-processing
    serviceAccountName: payload-processing
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: kube-api-access-nfgcc
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:10Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:06Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:21Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:21Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:06Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 25m
        memory: 32Mi
      containerID: cri-o://b28cfbbdc240f52f81e65837e8d399bd431ebe02f9ca076a915368d3b32e6014
      image: quay.io/opendatahub/odh-ai-gateway-payload-processing:36614760abfa1b3fb2b521a89097bdaf6e0693b5
      imageID: quay.io/opendatahub/odh-ai-gateway-payload-processing@sha256:011b396a7c9dc2381e14ef145ac83f0540bf27c4c920cd74e0096b628fd4ecb4
      lastState: {}
      name: payload-pre-processing
      ready: true
      resources:
        limits:
          cpu: 200m
          memory: 128Mi
        requests:
          cpu: 25m
          memory: 32Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:38:09Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000320000
          uid: 1000320000
      volumeMounts:
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-nfgcc
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.93
    hostIPs:
    - ip: 10.0.138.93
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.36
    podIPs:
    - ip: 10.132.0.36
    qosClass: Burstable
    startTime: "2026-06-13T05:38:06Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.34/23"],"mac_address":"0a:58:0a:85:00:22","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.34/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.34"
            ],
            "mac": "0a:58:0a:85:00:22",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-06-13T05:38:06Z"
    generateName: payload-processing-699b6cd6c-
    generation: 1
    labels:
      app: payload-processing
      app.kubernetes.io/component: api
      app.kubernetes.io/name: maas-api
      app.kubernetes.io/part-of: models-as-a-service
      pod-template-hash: 699b6cd6c
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-130-198
      operation: Update
      subresource: status
      time: "2026-06-13T05:38:06Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"fe507dd0-48cf-4ddc-b545-8da8795b76cc"}: {}
        f:spec:
          f:containers:
            k:{"name":"payload-processing"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"API_TRANSLATION"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:configMapKeyRef: {}
                k:{"name":"APIKEY_INJECTION"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:configMapKeyRef: {}
                k:{"name":"MODEL_PROVIDER_RESOLVER"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:configMapKeyRef: {}
                k:{"name":"MODEL_TO_HEADER"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:configMapKeyRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9004,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9005,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:38:06Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:38:07Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.34"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:38:21Z"
    name: payload-processing-699b6cd6c-7wlv9
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: payload-processing-699b6cd6c
      uid: fe507dd0-48cf-4ddc-b545-8da8795b76cc
    resourceVersion: "25307"
    uid: 7f098c97-f5d1-46fe-9916-b81f1d804880
  spec:
    containers:
    - args:
      - --streaming
      - --v
      - "3"
      - --plugin
      - $(MODEL_TO_HEADER)
      - --plugin
      - $(MODEL_PROVIDER_RESOLVER)
      - --plugin
      - $(API_TRANSLATION)
      - --plugin
      - $(APIKEY_INJECTION)
      - --tracing=false
      env:
      - name: MODEL_TO_HEADER
        valueFrom:
          configMapKeyRef:
            key: model-to-header-plugin
            name: payload-processing-plugins
      - name: MODEL_PROVIDER_RESOLVER
        valueFrom:
          configMapKeyRef:
            key: model-provider-resolver-plugin
            name: payload-processing-plugins
      - name: API_TRANSLATION
        valueFrom:
          configMapKeyRef:
            key: api-translation-plugin
            name: payload-processing-plugins
      - name: APIKEY_INJECTION
        valueFrom:
          configMapKeyRef:
            key: apikey-injection-plugin
            name: payload-processing-plugins
      image: quay.io/opendatahub/odh-ai-gateway-payload-processing:36614760abfa1b3fb2b521a89097bdaf6e0693b5
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 3
        initialDelaySeconds: 15
        periodSeconds: 20
        successThreshold: 1
        tcpSocket:
          port: grpc
        timeoutSeconds: 1
      name: payload-processing
      ports:
      - containerPort: 9004
        name: grpc
        protocol: TCP
      - containerPort: 9005
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1
        tcpSocket:
          port: grpc
        timeoutSeconds: 1
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 64Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000320000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6vmlw
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: payload-processing-dockercfg-gd762
    nodeName: ip-10-0-130-198.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c18,c7
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: payload-processing
    serviceAccountName: payload-processing
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: kube-api-access-6vmlw
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:09Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:06Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:21Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:21Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:38:06Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 50m
        memory: 64Mi
      containerID: cri-o://c7504e9ef4e3d5c6c92efab1f607d23bb74bf16e195e8d8cffcbc61d57fc5ae7
      image: quay.io/opendatahub/odh-ai-gateway-payload-processing:36614760abfa1b3fb2b521a89097bdaf6e0693b5
      imageID: quay.io/opendatahub/odh-ai-gateway-payload-processing@sha256:011b396a7c9dc2381e14ef145ac83f0540bf27c4c920cd74e0096b628fd4ecb4
      lastState: {}
      name: payload-processing
      ready: true
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 64Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:38:09Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000320000
          uid: 1000320000
      volumeMounts:
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6vmlw
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.130.198
    hostIPs:
    - ip: 10.0.130.198
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.34
    podIPs:
    - ip: 10.133.0.34
    qosClass: Burstable
    startTime: "2026-06-13T05:38:06Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.10/23"],"mac_address":"0a:58:0a:86:00:0a","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.10/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.10"
            ],
            "mac": "0a:58:0a:86:00:0a",
            "default": true,
            "dns": {}
        }]
      openshift.io/required-scc: restricted
      openshift.io/scc: restricted
      security.openshift.io/validated-scc-subject-type: serviceaccount
    creationTimestamp: "2026-06-13T05:27:52Z"
    generateName: router-default-559447c76b-
    generation: 1
    labels:
      ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
      ingresscontroller.operator.openshift.io/hash: bb8c88b89
      pod-template-hash: 559447c76b
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-220
      operation: Update
      subresource: status
      time: "2026-06-13T05:27:52Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:openshift.io/required-scc: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:ingresscontroller.operator.openshift.io/deployment-ingresscontroller: {}
            f:ingresscontroller.operator.openshift.io/hash: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"e0a9fa50-66bd-4438-8833-b1f8b1aa67e4"}: {}
        f:spec:
          f:affinity:
            .: {}
            f:nodeAffinity:
              .: {}
              f:requiredDuringSchedulingIgnoredDuringExecution: {}
          f:containers:
            k:{"name":"router"}:
              .: {}
              f:env:
                .: {}
                k:{"name":"DEFAULT_CERTIFICATE_DIR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"DEFAULT_DESTINATION_CA_PATH"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"RELOAD_INTERVAL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_ALLOW_WILDCARD_ROUTES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CANONICAL_HOSTNAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CIPHERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CIPHERSUITES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DISABLE_HTTP2"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_ENABLE_EXTERNAL_CERTIFICATE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_LOAD_BALANCE_ALGORITHM"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_CERT_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_KEY_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TYPE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SERVICE_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SERVICE_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SET_FORWARDED_HEADERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_TCP_BALANCE_SCHEME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_THREADS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_USE_PROXY_PROTOCOL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SSL_MIN_VERSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_PASSWORD_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_PORT"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_USERNAME_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:terminationGracePeriodSeconds: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":80,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":1936,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:readOnlyRootFilesystem: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/pki/tls/metrics-certs"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/etc/pki/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/lib/haproxy/conf/metrics-auth"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/configmaps/service-ca"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:topologySpreadConstraints:
            .: {}
            k:{"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"ScheduleAnyway"}:
              .: {}
              f:labelSelector: {}
              f:maxSkew: {}
              f:topologyKey: {}
              f:whenUnsatisfiable: {}
          f:volumes:
            .: {}
            k:{"name":"default-certificate"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"metrics-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"service-ca-bundle"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:items: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"stats-auth"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-06-13T05:27:52Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-06-13T05:28:09Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.10"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-06-13T05:28:10Z"
    name: router-default-559447c76b-bvt4s
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: router-default-559447c76b
      uid: e0a9fa50-66bd-4438-8833-b1f8b1aa67e4
    resourceVersion: "8926"
    uid: 901d69d5-6fb6-4f2d-a52a-fa2bfbcc4dc8
  spec:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: node.openshift.io/remote-worker
              operator: NotIn
              values:
              - ""
    containers:
    - env:
      - name: DEFAULT_CERTIFICATE_DIR
        value: /etc/pki/tls/private
      - name: DEFAULT_DESTINATION_CA_PATH
        value: /var/run/configmaps/service-ca/service-ca.crt
      - name: RELOAD_INTERVAL
        value: 5s
      - name: ROUTER_ALLOW_WILDCARD_ROUTES
        value: "false"
      - name: ROUTER_CANONICAL_HOSTNAME
        value: router-default.apps.c4ab367b-4c13-44ef-b768-9900faa78493.prod.konfluxeaas.com
      - name: ROUTER_CIPHERS
        value: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
      - name: ROUTER_CIPHERSUITES
        value: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
      - name: ROUTER_DISABLE_HTTP2
        value: "true"
      - name: ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK
        value: "false"
      - name: ROUTER_DOMAIN
        value: apps.c4ab367b-4c13-44ef-b768-9900faa78493.prod.konfluxeaas.com
      - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE
        value: "true"
      - name: ROUTER_LOAD_BALANCE_ALGORITHM
        value: random
      - name: ROUTER_METRICS_TLS_CERT_FILE
        value: /etc/pki/tls/metrics-certs/tls.crt
      - name: ROUTER_METRICS_TLS_KEY_FILE
        value: /etc/pki/tls/metrics-certs/tls.key
      - name: ROUTER_METRICS_TYPE
        value: haproxy
      - name: ROUTER_SERVICE_NAME
        value: default
      - name: ROUTER_SERVICE_NAMESPACE
        value: openshift-ingress
      - name: ROUTER_SET_FORWARDED_HEADERS
        value: append
      - name: ROUTER_TCP_BALANCE_SCHEME
        value: source
      - name: ROUTER_THREADS
        value: "4"
      - name: ROUTER_USE_PROXY_PROTOCOL
        value: "true"
      - name: SSL_MIN_VERSION
        value: TLSv1.2
      - name: STATS_PASSWORD_FILE
        value: /var/lib/haproxy/conf/metrics-auth/statsPassword
      - name: STATS_PORT
        value: "1936"
      - name: STATS_USERNAME_FILE
        value: /var/lib/haproxy/conf/metrics-auth/statsUsername
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:68c43f6705263ac9281e11c8a7628b5a094439fd5433a540504fa88630506200
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz
          port: 1936
          scheme: HTTP
        periodSeconds: 10
        successThreshold: 1
        terminationGracePeriodSeconds: 10
        timeoutSeconds: 1
      name: router
      ports:
      - containerPort: 80
        name: http
        protocol: TCP
      - containerPort: 443
        name: https
        protocol: TCP
      - containerPort: 1936
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz/ready
          port: 1936
          scheme: HTTP
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
      securityContext:
        allowPrivilegeEscalation: true
        capabilities:
          drop:
          - KILL
          - MKNOD
          - SETGID
          - SETUID
        readOnlyRootFilesystem: false
        runAsNonRoot: true
        runAsUser: 1000320000
      startupProbe:
        failureThreshold: 120
        httpGet:
          path: /healthz/ready
          port: 1936
          scheme: HTTP
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /etc/pki/tls/private
        name: default-certificate
        readOnly: true
      - mountPath: /var/run/configmaps/service-ca
        name: service-ca-bundle
        readOnly: true
      - mountPath: /var/lib/haproxy/conf/metrics-auth
        name: stats-auth
        readOnly: true
      - mountPath: /etc/pki/tls/metrics-certs
        name: metrics-certs
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-5vzs6
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: router-dockercfg-lpdv6
    nodeName: ip-10-0-140-220.ec2.internal
    nodeSelector:
      kubernetes.io/os: linux
      node-role.kubernetes.io/worker: ""
    preemptionPolicy: PreemptLowerPriority
    priority: 2000000000
    priorityClassName: system-cluster-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000320000
      seLinuxOptions:
        level: s0:c18,c7
    serviceAccount: router
    serviceAccountName: router
    terminationGracePeriodSeconds: 3600
    tolerations:
    - effect: NoExecute
      key: kubernetes.io/e2e-evict-taint-key
      operator: Equal
      value: evictTaintVal
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    topologySpreadConstraints:
    - labelSelector:
        matchExpressions:
        - key: ingresscontroller.operator.openshift.io/hash
          operator: In
          values:
          - bb8c88b89
      maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: ScheduleAnyway
    volumes:
    - name: default-certificate
      secret:
        defaultMode: 420
        secretName: default-ingress-cert
    - configMap:
        defaultMode: 420
        items:
        - key: service-ca.crt
          path: service-ca.crt
        name: service-ca-bundle
        optional: false
      name: service-ca-bundle
    - name: stats-auth
      secret:
        defaultMode: 420
        secretName: router-stats-default
    - name: metrics-certs
      secret:
        defaultMode: 420
        secretName: router-metrics-certs-default
    - name: kube-api-access-5vzs6
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:28:09Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:27:52Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:28:10Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:28:10Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-06-13T05:27:52Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 256Mi
      containerID: cri-o://42f3e779cf415e69c33dce83b65f2ad6cbbd165ea127dd080095b37f79a0d9f2
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:68c43f6705263ac9281e11c8a7628b5a094439fd5433a540504fa88630506200
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:68c43f6705263ac9281e11c8a7628b5a094439fd5433a540504fa88630506200
      lastState: {}
      name: router
      ready: true
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-06-13T05:28:09Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000320000
          uid: 1000320000
      volumeMounts:
      - mountPath: /etc/pki/tls/private
        name: default-certificate
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/configmaps/service-ca
        name: service-ca-bundle
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/lib/haproxy/conf/metrics-auth
        name: stats-auth
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /etc/pki/tls/metrics-certs
        name: metrics-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-5vzs6
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.220
    hostIPs:
    - ip: 10.0.140.220
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.10
    podIPs:
    - ip: 10.134.0.10
    qosClass: Burstable
    startTime: "2026-06-13T05:27:52Z"
kind: PodList
metadata:
  resourceVersion: "33174"