---
apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.42/23"],"mac_address":"0a:58:0a:84:00:2a","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.42/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.42"
            ],
            "mac": "0a:58:0a:84:00:2a",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T13:49:26Z"
    generateName: data-science-gateway-data-science-gateway-class-7845f94dd5-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: data-science-gateway-class
      gateway.networking.k8s.io/gateway-name: data-science-gateway
      pod-template-hash: 7845f94dd5
      service.istio.io/canonical-name: data-science-gateway-data-science-gateway-class
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"e6107a09-636c-47b0-8471-5ec0036dc950"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:49:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.42"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:29Z"
    name: data-science-gateway-data-science-gateway-class-7845f94dd5qfcdv
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: data-science-gateway-data-science-gateway-class-7845f94dd5
      uid: e6107a09-636c-47b0-8471-5ec0036dc950
    resourceVersion: "15371"
    uid: 4983a055-8bd9-43ad-ba61-20cdb90ed101
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: data-science-gateway-data-science-gateway-class
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/data-science-gateway-data-science-gateway-class
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-znw7g
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: data-science-gateway-data-science-gateway-class-dockercfg-ztk5s
    nodeName: ip-10-0-139-26.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: data-science-gateway-data-science-gateway-class
    serviceAccountName: data-science-gateway-data-science-gateway-class
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-znw7g
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:26Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:29Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:29Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:26Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://e95891ca1f72d37367c58c9a66db48775856b76e86539b8aba0c6c25b7561364
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:49:27Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-znw7g
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.42
    podIPs:
    - ip: 10.132.0.42
    qosClass: Burstable
    startTime: "2026-11-02T13:49:26Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.20/23"],"mac_address":"0a:58:0a:85:00:14","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.20/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.20"
            ],
            "mac": "0a:58:0a:85:00:14",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/port: "15014"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
      sidecar.istio.io/inject: "false"
    creationTimestamp: "2026-11-02T13:50:28Z"
    generateName: istiod-openshift-gateway-7ddd9cfdc8-
    generation: 1
    labels:
      app: istiod
      app.kubernetes.io/instance: openshift-gateway-istiod
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: istiod
      app.kubernetes.io/part-of: istio
      app.kubernetes.io/version: 1.28.10
      helm.sh/chart: istiod-1.28.10
      istio: istiod
      istio.io/dataplane-mode: none
      istio.io/rev: openshift-gateway
      operator.istio.io/component: Pilot
      pod-template-hash: 7ddd9cfdc8
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-236
      operation: Update
      subresource: status
      time: "2026-11-02T13:50:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
            f:sidecar.istio.io/inject: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
            f:istio: {}
            f:istio.io/dataplane-mode: {}
            f:istio.io/rev: {}
            f:operator.istio.io/component: {}
            f:pod-template-hash: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"d8dc2db4-4f65-4ae4-9608-146e59ea4013"}: {}
        f:spec:
          f:containers:
            k:{"name":"discovery"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_TRUSTED_NODE_ACCOUNTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ENABLE_GATEWAY_API_INFERENCE_EXTENSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"KUBECONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CA_CERT_CONFIGMAP"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_ALPHA_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_ANALYSIS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_ENABLE_GATEWAY_API_STATUS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_GATEWAY_API_CONTROLLER_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_TRACE_SAMPLING"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PLATFORM"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"REVISION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"X_PILOT_IGNORE_RESOURCES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"X_PILOT_INCLUDE_RESOURCES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":8080,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15010,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15012,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15014,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15017,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
                f:runAsNonRoot: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/cacerts"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/istio-dns"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istiod/ca"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/istiod/tls"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/remote"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:volumes:
            .: {}
            k:{"name":"cacerts"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-csr-ca-configmap"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"istio-csr-dns-cert"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-kubeconfig"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:optional: {}
                f:secretName: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"local-certs"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:50:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:50:29Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.20"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:50:30Z"
    name: istiod-openshift-gateway-7ddd9cfdc8-tnmvk
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: istiod-openshift-gateway-7ddd9cfdc8
      uid: d8dc2db4-4f65-4ae4-9608-146e59ea4013
    resourceVersion: "16897"
    uid: f3247735-5d35-43ac-a9cd-48c53d43ab19
  spec:
    containers:
    - args:
      - discovery
      - --monitoringAddr=:15014
      - --log_output_level=default:info
      - --domain
      - cluster.local
      - --keepaliveMaxServerConnectionAge
      - 30m
      env:
      - name: REVISION
        value: openshift-gateway
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: KUBECONFIG
        value: /var/run/secrets/remote/config
      - name: CA_TRUSTED_NODE_ACCOUNTS
        value: kube-system/ztunnel
      - name: ENABLE_GATEWAY_API_INFERENCE_EXTENSION
        value: "true"
      - name: ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
        value: "false"
      - name: PILOT_ENABLE_ALPHA_GATEWAY_API
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER
        value: "true"
      - name: PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER
        value: "false"
      - name: PILOT_ENABLE_GATEWAY_API_STATUS
        value: "true"
      - name: PILOT_GATEWAY_API_CONTROLLER_NAME
        value: openshift.io/gateway-controller/v1
      - name: PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME
        value: openshift-default
      - name: PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API
        value: "false"
      - name: X_PILOT_IGNORE_RESOURCES
        value: '*.istio.io'
      - name: X_PILOT_INCLUDE_RESOURCES
        value: wasmplugins.extensions.istio.io,envoyfilters.networking.istio.io,destinationrules.networking.istio.io
      - name: PILOT_TRACE_SAMPLING
        value: "1"
      - name: PILOT_CA_CERT_CONFIGMAP
        value: openshift-gw-ca-root-cert
      - name: PILOT_ENABLE_ANALYSIS
        value: "false"
      - name: CLUSTER_ID
        value: Kubernetes
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "1"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "1"
            resource: limits.cpu
      - name: PLATFORM
        value: openshift
      image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:d5adf3101d4e14c710cd05afb3fa53498e3c5fb31a120f1bb007fba2e3b376f8
      imagePullPolicy: IfNotPresent
      name: discovery
      ports:
      - containerPort: 8080
        name: http-debug
        protocol: TCP
      - containerPort: 15010
        name: grpc-xds
        protocol: TCP
      - containerPort: 15012
        name: tls-xds
        protocol: TCP
      - containerPort: 15017
        name: https-webhooks
        protocol: TCP
      - containerPort: 15014
        name: http-monitoring
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /ready
          port: 8080
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 3
        successThreshold: 1
        timeoutSeconds: 5
      resources:
        requests:
          cpu: 500m
          memory: 2Gi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000240000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/tokens
        name: istio-token
        readOnly: true
      - mountPath: /var/run/secrets/istio-dns
        name: local-certs
      - mountPath: /etc/cacerts
        name: cacerts
        readOnly: true
      - mountPath: /var/run/secrets/remote
        name: istio-kubeconfig
        readOnly: true
      - mountPath: /var/run/secrets/istiod/tls
        name: istio-csr-dns-cert
        readOnly: true
      - mountPath: /var/run/secrets/istiod/ca
        name: istio-csr-ca-configmap
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-hh5hk
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: istiod-openshift-gateway-dockercfg-5wglw
    nodeName: ip-10-0-140-236.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 2000000000
    priorityClassName: system-cluster-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: istiod-openshift-gateway
    serviceAccountName: istiod-openshift-gateway
    terminationGracePeriodSeconds: 30
    tolerations:
    - key: cni.istio.io/not-ready
      operator: Exists
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir:
        medium: Memory
      name: local-certs
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - name: cacerts
      secret:
        defaultMode: 420
        optional: true
        secretName: cacerts
    - name: istio-kubeconfig
      secret:
        defaultMode: 420
        optional: true
        secretName: istio-kubeconfig
    - name: istio-csr-dns-cert
      secret:
        defaultMode: 420
        optional: true
        secretName: istiod-tls
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
        optional: true
      name: istio-csr-ca-configmap
    - name: kube-api-access-hh5hk
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:50:29Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:50:28Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:50:30Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:50:30Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:50:28Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 2Gi
      containerID: cri-o://94560d8f3ef97310517d7f9221bcbce3663db245c0dd5f78bbd748650f3e0b0d
      image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:d5adf3101d4e14c710cd05afb3fa53498e3c5fb31a120f1bb007fba2e3b376f8
      imageID: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:78b8134d45567565eb0eb365042b3c43414fed25e8d1b4b40d3029e864d9f72b
      lastState: {}
      name: discovery
      ready: true
      resources:
        requests:
          cpu: 500m
          memory: 2Gi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:50:29Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000240000
          uid: 1000240000
      volumeMounts:
      - mountPath: /var/run/secrets/tokens
        name: istio-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istio-dns
        name: local-certs
      - mountPath: /etc/cacerts
        name: cacerts
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/remote
        name: istio-kubeconfig
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istiod/tls
        name: istio-csr-dns-cert
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/istiod/ca
        name: istio-csr-ca-configmap
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-hh5hk
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.236
    hostIPs:
    - ip: 10.0.140.236
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.20
    podIPs:
    - ip: 10.133.0.20
    qosClass: Burstable
    startTime: "2026-11-02T13:50:28Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.17/23"],"mac_address":"0a:58:0a:85:00:11","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.17/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.17"
            ],
            "mac": "0a:58:0a:85:00:11",
            "default": true,
            "dns": {}
        }]
      opendatahub.io/secret-hash: e7f861bd847be8bc9a0ef81bda8e0ebb91e94397f1a75c902481c3bba4941e10
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T13:49:26Z"
    generateName: kube-auth-proxy-6fd64f76dd-
    generation: 1
    labels:
      app: kube-auth-proxy
      app.kubernetes.io/component: authentication
      pod-template-hash: 6fd64f76dd
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-236
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:opendatahub.io/secret-hash: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"33b63a1d-bd0d-41e5-b1d1-c9af7faa4923"}: {}
        f:spec:
          f:containers:
            k:{"name":"kube-auth-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_ID"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_COOKIE_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":4180,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":8443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9000,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/tmp"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"tls-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"tmp"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
                f:sizeLimit: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:49:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.17"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:30Z"
    name: kube-auth-proxy-6fd64f76dd-9f2pc
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: kube-auth-proxy-6fd64f76dd
      uid: 33b63a1d-bd0d-41e5-b1d1-c9af7faa4923
    resourceVersion: "15502"
    uid: a0c62419-de89-4af5-951b-52a33f4ac5b1
  spec:
    containers:
    - args:
      - --http-address=0.0.0.0:4180
      - --https-address=0.0.0.0:8443
      - --metrics-address=0.0.0.0:9000
      - --email-domain=*
      - --upstream=static://200
      - --skip-provider-button
      - --skip-jwt-bearer-tokens=true
      - --pass-access-token=true
      - --set-xauthrequest=true
      - --enable-k8s-token-validation=true
      - --redirect-url=https://rh-ai.apps.59ad8915e5dac481f8f4.prod.konflux-ocp-ci.dev/oauth2/callback
      - --tls-cert-file=/etc/tls/private/tls.crt
      - --tls-key-file=/etc/tls/private/tls.key
      - --tls-min-version=TLS1.2
      - --tls-cipher-suite=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
      - --use-system-trust-store=true
      - --cookie-expire=24h0m0s
      - --cookie-refresh=1h0m0s
      - --cookie-secure=true
      - --cookie-httponly=true
      - --cookie-samesite=lax
      - --cookie-name=_oauth2_proxy
      - --cookie-domain=rh-ai.apps.59ad8915e5dac481f8f4.prod.konflux-ocp-ci.dev
      - --provider=openshift
      - --ssl-insecure-skip-verify=false
      - --scope=user:full
      env:
      - name: OAUTH2_PROXY_CLIENT_ID
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_ID
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_SECRET
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_COOKIE_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_COOKIE_SECRET
            name: kube-auth-proxy-creds
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imagePullPolicy: IfNotPresent
      name: kube-auth-proxy
      ports:
      - containerPort: 4180
        name: http
        protocol: TCP
      - containerPort: 8443
        name: https
        protocol: TCP
      - containerPort: 9000
        name: metrics
        protocol: TCP
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000240000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-jswdv
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: kube-auth-proxy-dockercfg-4tb9q
    nodeName: ip-10-0-140-236.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: kube-auth-proxy
    serviceAccountName: kube-auth-proxy
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: tls-certs
      secret:
        defaultMode: 420
        secretName: kube-auth-proxy-tls
    - emptyDir:
        medium: Memory
        sizeLimit: 10Mi
      name: tmp
    - name: kube-api-access-jswdv
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:30Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:26Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:30Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:30Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:26Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 128Mi
      containerID: cri-o://0c1921148cf4a019f98ae98c3d78e3942e8de9ddb8884d9a102b3c5f18425eac
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imageID: quay.io/opendatahub/odh-kube-auth-proxy@sha256:784e47ce6cbf2b41d23eb6009482ba6bf8503d4c77aae491aa813cade5626851
      lastState: {}
      name: kube-auth-proxy
      ready: true
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:49:29Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000240000
          uid: 1000240000
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-jswdv
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.236
    hostIPs:
    - ip: 10.0.140.236
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.17
    podIPs:
    - ip: 10.133.0.17
    qosClass: Burstable
    startTime: "2026-11-02T13:49:26Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.31/23"],"mac_address":"0a:58:0a:86:00:1f","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.31/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.31"
            ],
            "mac": "0a:58:0a:86:00:1f",
            "default": true,
            "dns": {}
        }]
      opendatahub.io/secret-hash: e7f861bd847be8bc9a0ef81bda8e0ebb91e94397f1a75c902481c3bba4941e10
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T13:49:26Z"
    generateName: kube-auth-proxy-6fd64f76dd-
    generation: 1
    labels:
      app: kube-auth-proxy
      app.kubernetes.io/component: authentication
      pod-template-hash: 6fd64f76dd
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-131-98
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:opendatahub.io/secret-hash: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"33b63a1d-bd0d-41e5-b1d1-c9af7faa4923"}: {}
        f:spec:
          f:containers:
            k:{"name":"kube-auth-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_ID"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_CLIENT_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
                k:{"name":"OAUTH2_PROXY_COOKIE_SECRET"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:secretKeyRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":4180,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":8443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9000,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/tmp"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"tls-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"tmp"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
                f:sizeLimit: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:49:26Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.31"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:49:30Z"
    name: kube-auth-proxy-6fd64f76dd-lv2hm
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: kube-auth-proxy-6fd64f76dd
      uid: 33b63a1d-bd0d-41e5-b1d1-c9af7faa4923
    resourceVersion: "15516"
    uid: c3827235-f5e4-44cb-8b10-af6b6d82b14b
  spec:
    containers:
    - args:
      - --http-address=0.0.0.0:4180
      - --https-address=0.0.0.0:8443
      - --metrics-address=0.0.0.0:9000
      - --email-domain=*
      - --upstream=static://200
      - --skip-provider-button
      - --skip-jwt-bearer-tokens=true
      - --pass-access-token=true
      - --set-xauthrequest=true
      - --enable-k8s-token-validation=true
      - --redirect-url=https://rh-ai.apps.59ad8915e5dac481f8f4.prod.konflux-ocp-ci.dev/oauth2/callback
      - --tls-cert-file=/etc/tls/private/tls.crt
      - --tls-key-file=/etc/tls/private/tls.key
      - --tls-min-version=TLS1.2
      - --tls-cipher-suite=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
      - --use-system-trust-store=true
      - --cookie-expire=24h0m0s
      - --cookie-refresh=1h0m0s
      - --cookie-secure=true
      - --cookie-httponly=true
      - --cookie-samesite=lax
      - --cookie-name=_oauth2_proxy
      - --cookie-domain=rh-ai.apps.59ad8915e5dac481f8f4.prod.konflux-ocp-ci.dev
      - --provider=openshift
      - --ssl-insecure-skip-verify=false
      - --scope=user:full
      env:
      - name: OAUTH2_PROXY_CLIENT_ID
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_ID
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_CLIENT_SECRET
            name: kube-auth-proxy-creds
      - name: OAUTH2_PROXY_COOKIE_SECRET
        valueFrom:
          secretKeyRef:
            key: OAUTH2_PROXY_COOKIE_SECRET
            name: kube-auth-proxy-creds
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imagePullPolicy: IfNotPresent
      name: kube-auth-proxy
      ports:
      - containerPort: 4180
        name: http
        protocol: TCP
      - containerPort: 8443
        name: https
        protocol: TCP
      - containerPort: 9000
        name: metrics
        protocol: TCP
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000240000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dmjd9
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: kube-auth-proxy-dockercfg-4tb9q
    nodeName: ip-10-0-131-98.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: kube-auth-proxy
    serviceAccountName: kube-auth-proxy
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - name: tls-certs
      secret:
        defaultMode: 420
        secretName: kube-auth-proxy-tls
    - emptyDir:
        medium: Memory
        sizeLimit: 10Mi
      name: tmp
    - name: kube-api-access-dmjd9
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:30Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:26Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:30Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:30Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:49:26Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 500m
        memory: 128Mi
      containerID: cri-o://fc35467da729254e851290c4f185874d67174c9fc57a07dc50e86cd18d72701e
      image: quay.io/opendatahub/odh-kube-auth-proxy@sha256:d90930380151490d5516eeb95840eecc743e9005fc02733dec6fe79e1a00e035
      imageID: quay.io/opendatahub/odh-kube-auth-proxy@sha256:784e47ce6cbf2b41d23eb6009482ba6bf8503d4c77aae491aa813cade5626851
      lastState: {}
      name: kube-auth-proxy
      ready: true
      resources:
        limits:
          memory: 128Mi
        requests:
          cpu: 500m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:49:30Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000240000
          uid: 1000240000
      volumeMounts:
      - mountPath: /etc/tls/private
        name: tls-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /tmp
        name: tmp
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dmjd9
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.131.98
    hostIPs:
    - ip: 10.0.131.98
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.31
    podIPs:
    - ip: 10.134.0.31
    qosClass: Burstable
    startTime: "2026-11-02T13:49:26Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.44/23"],"mac_address":"0a:58:0a:86:00:2c","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.44/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.44"
            ],
            "mac": "0a:58:0a:86:00:2c",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T13:53:15Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-131-98
      operation: Update
      subresource: status
      time: "2026-11-02T13:53:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:53:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:53:15Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.44"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:53:24Z"
    name: maas-default-gateway-openshift-default-6886b96f9-49rxk
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "21130"
    uid: eb79c248-2d1c-42a1-82dd-57d1545d5588
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6rq4b
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-131-98.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-6rq4b
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:16Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:15Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:24Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:24Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:15Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://c3bc638de659857cbbb17b36074d2948a58b6a325d66254dd45f89321f5d1c2c
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:53:15Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6rq4b
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.131.98
    hostIPs:
    - ip: 10.0.131.98
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.44
    podIPs:
    - ip: 10.134.0.44
    qosClass: Burstable
    startTime: "2026-11-02T13:53:15Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.1.182/23"],"mac_address":"0a:58:0a:84:01:b6","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.1.182/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.1.182"
            ],
            "mac": "0a:58:0a:84:01:b6",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T15:00:27Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.1.182"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:38Z"
    name: maas-default-gateway-openshift-default-6886b96f9-4s5pw
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "187435"
    uid: 6b68886e-53d7-470d-8d43-893f733dae8f
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-fzlhg
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-139-26.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-fzlhg
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://1f66129e1fac694d3d244ae9a32cc019d36f32cca57a07c8b896004993065fdd
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T15:00:28Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-fzlhg
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.1.182
    podIPs:
    - ip: 10.132.1.182
    qosClass: Burstable
    startTime: "2026-11-02T15:00:27Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.1.183/23"],"mac_address":"0a:58:0a:84:01:b7","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.1.183/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.1.183"
            ],
            "mac": "0a:58:0a:84:01:b7",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T15:00:27Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.1.183"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:37Z"
    name: maas-default-gateway-openshift-default-6886b96f9-8glk8
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "187422"
    uid: dcf337cc-18f5-4451-88fe-351cf905dca8
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-95qxz
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-139-26.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-95qxz
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://3684fbef0b786325aca37ec153b4eccb215dd9471ccc382cb53879f648b4d3a6
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T15:00:28Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-95qxz
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.1.183
    podIPs:
    - ip: 10.132.1.183
    qosClass: Burstable
    startTime: "2026-11-02T15:00:27Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.162/23"],"mac_address":"0a:58:0a:86:00:a2","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.162/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.162"
            ],
            "mac": "0a:58:0a:86:00:a2",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T14:47:55Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-131-98
      operation: Update
      subresource: status
      time: "2026-11-02T14:47:55Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T14:47:55Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T14:47:56Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.162"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T14:48:05Z"
    name: maas-default-gateway-openshift-default-6886b96f9-dpxqg
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "159402"
    uid: 578e528e-aff8-416c-94b5-9bf6cc01a4cc
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-hztnk
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-131-98.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-hztnk
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:47:57Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:47:55Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:05Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:05Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:47:55Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://8b926e24dd563dc01f6fb110db3c58596fb9dea60b4c8dd128f0682d3d743ba3
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T14:47:56Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-hztnk
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.131.98
    hostIPs:
    - ip: 10.0.131.98
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.162
    podIPs:
    - ip: 10.134.0.162
    qosClass: Burstable
    startTime: "2026-11-02T14:47:55Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.1.185/23"],"mac_address":"0a:58:0a:84:01:b9","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.1.185/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.1.185"
            ],
            "mac": "0a:58:0a:84:01:b9",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T15:00:27Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.1.185"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:37Z"
    name: maas-default-gateway-openshift-default-6886b96f9-kbj7z
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "187430"
    uid: 43892ef8-c4cc-414e-bc41-d1626001a0fa
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m4djd
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-139-26.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-m4djd
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://eb74c0c524ac4ef61449a89b999235b3594ec3d161f928727190728bc306600e
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T15:00:28Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m4djd
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.1.185
    podIPs:
    - ip: 10.132.1.185
    qosClass: Burstable
    startTime: "2026-11-02T15:00:27Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.163/23"],"mac_address":"0a:58:0a:86:00:a3","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.163/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.163"
            ],
            "mac": "0a:58:0a:86:00:a3",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T14:48:10Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-131-98
      operation: Update
      subresource: status
      time: "2026-11-02T14:48:10Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T14:48:10Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T14:48:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.163"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T14:48:20Z"
    name: maas-default-gateway-openshift-default-6886b96f9-lfj9p
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "159953"
    uid: 17e32694-fbfc-4adc-aef1-7936996fe885
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m8tzh
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-131-98.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-m8tzh
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:11Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:10Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:20Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:20Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:10Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://1da396831ef03a96ed18a0829d5f01c97ce25adcb83c6ac47929798d88bd3eea
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T14:48:11Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m8tzh
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.131.98
    hostIPs:
    - ip: 10.0.131.98
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.163
    podIPs:
    - ip: 10.134.0.163
    qosClass: Burstable
    startTime: "2026-11-02T14:48:10Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.1.52/23"],"mac_address":"0a:58:0a:85:01:34","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.1.52/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.1.52"
            ],
            "mac": "0a:58:0a:85:01:34",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T15:00:27Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-236
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.1.52"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:36Z"
    name: maas-default-gateway-openshift-default-6886b96f9-qqfsh
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "187398"
    uid: ad6d5b6e-e351-4020-81b4-98bb9d0a013a
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-52sbv
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-140-236.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-52sbv
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:36Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:36Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://7c23e71793afa14f935103fa6bc126aee90cf3f5bd4b3a49edba193a1da67903
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T15:00:28Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-52sbv
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.236
    hostIPs:
    - ip: 10.0.140.236
    observedGeneration: 1
    phase: Running
    podIP: 10.133.1.52
    podIPs:
    - ip: 10.133.1.52
    qosClass: Burstable
    startTime: "2026-11-02T15:00:27Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.1.184/23"],"mac_address":"0a:58:0a:84:01:b8","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.1.184/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.1.184"
            ],
            "mac": "0a:58:0a:84:01:b8",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T15:00:27Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T15:00:27Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:28Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.1.184"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T15:00:38Z"
    name: maas-default-gateway-openshift-default-6886b96f9-thsm4
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "187442"
    uid: 565989d2-f1a9-4413-a50d-fd54da149761
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-9dg9d
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-139-26.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-9dg9d
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:28Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:37Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:00:27Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://ea4a9e7729be97e65fd53568267d3503a7ac2e2629f65ec30f0d131195cddd65
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T15:00:28Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-9dg9d
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.1.184
    podIPs:
    - ip: 10.132.1.184
    qosClass: Burstable
    startTime: "2026-11-02T15:00:27Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.30/23"],"mac_address":"0a:58:0a:85:00:1e","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.30/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.30"
            ],
            "mac": "0a:58:0a:85:00:1e",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T13:53:00Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-236
      operation: Update
      subresource: status
      time: "2026-11-02T13:53:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:53:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:53:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.30"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:53:11Z"
    name: maas-default-gateway-openshift-default-6886b96f9-wrbs7
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "20562"
    uid: dae59a45-652a-46dc-a5e7-c983d14b2b7e
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6t45q
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-140-236.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-6t45q
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:04Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:00Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:11Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:11Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:53:00Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://f7f19e0a014d840172834e48af7462048b73d0444ed79ccd6e224a88743691de
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:53:03Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6t45q
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.236
    hostIPs:
    - ip: 10.0.140.236
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.30
    podIPs:
    - ip: 10.133.0.30
    qosClass: Burstable
    startTime: "2026-11-02T13:53:00Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.1.37/23"],"mac_address":"0a:58:0a:85:01:25","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.1.37/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.1.37"
            ],
            "mac": "0a:58:0a:85:01:25",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T14:48:10Z"
    generateName: maas-default-gateway-openshift-default-6886b96f9-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-default
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 6886b96f9
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-236
      operation: Update
      subresource: status
      time: "2026-11-02T14:48:10Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ec4d8e73-2536-45d1-98ca-d345ae130f47"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T14:48:10Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T14:48:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.1.37"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T14:48:19Z"
    name: maas-default-gateway-openshift-default-6886b96f9-xqg2g
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: maas-default-gateway-openshift-default-6886b96f9
      uid: ec4d8e73-2536-45d1-98ca-d345ae130f47
    resourceVersion: "159935"
    uid: cf93ec7a-9a28-4e39-b0e2-79e786e431de
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: maas-default-gateway-openshift-default
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-9wplc
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: maas-default-gateway-openshift-default-dockercfg-27gvt
    nodeName: ip-10-0-140-236.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: maas-default-gateway-openshift-default
    serviceAccountName: maas-default-gateway-openshift-default
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-9wplc
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:11Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:10Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:19Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:19Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T14:48:10Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://ea851acb5cad3e61892cf0f937495662c935f12a532a24a7cc5c8d2d3a67333e
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T14:48:11Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-9wplc
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.236
    hostIPs:
    - ip: 10.0.140.236
    observedGeneration: 1
    phase: Running
    podIP: 10.133.1.37
    podIPs:
    - ip: 10.133.1.37
    qosClass: Burstable
    startTime: "2026-11-02T14:48:10Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      istio.io/rev: openshift-gateway
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.38/23"],"mac_address":"0a:58:0a:84:00:26","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.38/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.38"
            ],
            "mac": "0a:58:0a:84:00:26",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /stats/prometheus
      prometheus.io/port: "15020"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T13:47:59Z"
    generateName: openshift-ai-inference-openshift-ai-inference-55f56bc75f-
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-class-name: openshift-ai-inference
      gateway.networking.k8s.io/gateway-name: openshift-ai-inference
      pod-template-hash: 55f56bc75f
      service.istio.io/canonical-name: openshift-ai-inference-openshift-ai-inference
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T13:47:59Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:istio.io/rev: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-class-name: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"b59fb301-80cc-4c2a-ae06-074ebe65f17d"}: {}
        f:spec:
          f:containers:
            k:{"name":"istio-proxy"}:
              .: {}
              f:args: {}
              f:env:
                .: {}
                k:{"name":"CA_ADDR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"GOMAXPROCS"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"GOMEMLIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"HOST_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"INSTANCE_IP"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_CPU_LIMIT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:resourceFieldRef: {}
                k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                  .: {}
                  f:name: {}
                k:{"name":"ISTIO_META_CLUSTER_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_MESH_ID"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"ISTIO_META_OWNER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_POD_PORTS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"PILOT_CERT_PROVIDER"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"POD_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"PROXY_CONFIG"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SERVICE_ACCOUNT"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"TRUST_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":15020,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15021,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":15090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:privileged: {}
                f:readOnlyRootFilesystem: {}
                f:runAsGroup: {}
                f:runAsNonRoot: {}
                f:runAsUser: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/istio/pod"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/istio/proxy"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/lib/istio/data"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/credential-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/istio"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/tokens"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:sysctls: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"credential-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-data"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"istio-envoy"}:
              .: {}
              f:emptyDir:
                .: {}
                f:medium: {}
              f:name: {}
            k:{"name":"istio-podinfo"}:
              .: {}
              f:downwardAPI:
                .: {}
                f:defaultMode: {}
                f:items: {}
              f:name: {}
            k:{"name":"istio-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
            k:{"name":"istiod-ca-cert"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
            k:{"name":"workload-certs"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
            k:{"name":"workload-socket"}:
              .: {}
              f:emptyDir: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:47:59Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:48:00Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.38"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:48:05Z"
    name: openshift-ai-inference-openshift-ai-inference-55f56bc75f-swzhg
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: openshift-ai-inference-openshift-ai-inference-55f56bc75f
      uid: b59fb301-80cc-4c2a-ae06-074ebe65f17d
    resourceVersion: "10379"
    uid: 50a1f6b2-1feb-4aaa-bbb7-f224ce55f893
  spec:
    containers:
    - args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel
      - warning
      - --proxyComponentLogLevel
      - misc:error
      - --log_output_level
      - default:info
      env:
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-openshift-gateway.openshift-ingress.svc:15012
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: ISTIO_CPU_LIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: PROXY_CONFIG
        value: |
          {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
      - name: ISTIO_META_POD_PORTS
        value: '[]'
      - name: ISTIO_META_APP_CONTAINERS
      - name: GOMEMLIMIT
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.memory
      - name: GOMAXPROCS
        valueFrom:
          resourceFieldRef:
            divisor: "0"
            resource: limits.cpu
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: ISTIO_META_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: ISTIO_META_INTERCEPTION_MODE
        value: REDIRECT
      - name: ISTIO_META_WORKLOAD_NAME
        value: openshift-ai-inference-openshift-ai-inference
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/openshift-ai-inference-openshift-ai-inference
      - name: ISTIO_META_MESH_ID
        value: cluster.local
      - name: TRUST_DOMAIN
        value: cluster.local
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imagePullPolicy: IfNotPresent
      name: istio-proxy
      ports:
      - containerPort: 15020
        name: metrics
        protocol: TCP
      - containerPort: 15021
        name: status-port
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
      readinessProbe:
        failureThreshold: 4
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        periodSeconds: 15
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 1000249999
        runAsNonRoot: true
        runAsUser: 1000249999
      startupProbe:
        failureThreshold: 30
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-g7rgv
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: openshift-ai-inference-openshift-ai-inference-dockercfg-mfmh5
    nodeName: ip-10-0-139-26.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
      sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"
    serviceAccount: openshift-ai-inference-openshift-ai-inference
    serviceAccountName: openshift-ai-inference-openshift-ai-inference
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - emptyDir: {}
      name: workload-socket
    - emptyDir: {}
      name: credential-socket
    - emptyDir: {}
      name: workload-certs
    - emptyDir:
        medium: Memory
      name: istio-envoy
    - emptyDir: {}
      name: istio-data
    - downwardAPI:
        defaultMode: 420
        items:
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels
          path: labels
        - fieldRef:
            apiVersion: v1
            fieldPath: metadata.annotations
          path: annotations
      name: istio-podinfo
    - name: istio-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: istio-ca
            expirationSeconds: 43200
            path: istio-token
    - configMap:
        defaultMode: 420
        name: openshift-gw-ca-root-cert
      name: istiod-ca-cert
    - name: kube-api-access-g7rgv
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:48:03Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:47:59Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:48:05Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:48:05Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:47:59Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 128Mi
      containerID: cri-o://45093df99e5dbb477cca1d18d8ad7e4bcb6256ca249994f5675cb6f680443d83
      image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      imageID: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1fc05d17a76d31503f68c5bde3057750a2c575981535756112c06589f88c8c55
      lastState: {}
      name: istio-proxy
      ready: true
      resources:
        limits:
          cpu: "2"
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 128Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:48:03Z"
      user:
        linux:
          gid: 1000249999
          supplementalGroups:
          - 1000249999
          - 1000240000
          uid: 1000249999
      volumeMounts:
      - mountPath: /var/run/secrets/workload-spiffe-uds
        name: workload-socket
      - mountPath: /var/run/secrets/credential-uds
        name: credential-socket
      - mountPath: /var/run/secrets/workload-spiffe-credentials
        name: workload-certs
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /var/run/secrets/tokens
        name: istio-token
      - mountPath: /etc/istio/pod
        name: istio-podinfo
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-g7rgv
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.38
    podIPs:
    - ip: 10.132.0.38
    qosClass: Burstable
    startTime: "2026-11-02T13:47:59Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.1.73/23"],"mac_address":"0a:58:0a:85:01:49","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.1.73/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.1.73"
            ],
            "mac": "0a:58:0a:85:01:49",
            "default": true,
            "dns": {}
        }]
      kubectl.kubernetes.io/restartedAt: "2026-11-02T15:08:03Z"
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T15:08:03Z"
    generateName: payload-pre-processing-84dc7c97f-
    generation: 1
    labels:
      app: payload-pre-processing
      app.kubernetes.io/managed-by: ai-gateway-controller
      maas.opendatahub.io/tenant-instance: payload-pre-processing
      pod-template-hash: 84dc7c97f
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-140-236
      operation: Update
      subresource: status
      time: "2026-11-02T15:08:03Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:kubectl.kubernetes.io/restartedAt: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/managed-by: {}
            f:maas.opendatahub.io/tenant-instance: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ad1e4a94-db5e-4d36-bd34-ee0a8de672bb"}: {}
        f:spec:
          f:containers:
            k:{"name":"payload-pre-processing"}:
              .: {}
              f:args: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:lifecycle:
                .: {}
                f:preStop:
                  .: {}
                  f:sleep:
                    .: {}
                    f:seconds: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9004,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":50052,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:grpc:
                  .: {}
                  f:port: {}
                  f:service: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
                f:runAsNonRoot: {}
                f:seccompProfile:
                  .: {}
                  f:type: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/praxis"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"plugins-config-volume"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T15:08:03Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T15:08:03Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.1.73"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T15:08:15Z"
    name: payload-pre-processing-84dc7c97f-5mmbq
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: payload-pre-processing-84dc7c97f
      uid: ad1e4a94-db5e-4d36-bd34-ee0a8de672bb
    resourceVersion: "195551"
    uid: f88a9ba7-3c6d-47dd-aae0-da3b997533e8
  spec:
    containers:
    - args:
      - -c
      - /etc/praxis/pre-extproc.yaml
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imagePullPolicy: IfNotPresent
      lifecycle:
        preStop:
          sleep:
            seconds: 5
      livenessProbe:
        failureThreshold: 3
        initialDelaySeconds: 15
        periodSeconds: 20
        successThreshold: 1
        tcpSocket:
          port: health
        timeoutSeconds: 1
      name: payload-pre-processing
      ports:
      - containerPort: 9004
        name: grpc
        protocol: TCP
      - containerPort: 50052
        name: health
        protocol: TCP
      - containerPort: 9090
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        grpc:
          port: 50052
          service: envoy.service.ext_proc.v3.ExternalProcessor
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: 200m
          memory: 128Mi
        requests:
          cpu: 25m
          memory: 32Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000240000
        seccompProfile:
          type: RuntimeDefault
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-5d6fl
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: payload-processing-dockercfg-964jt
    nodeName: ip-10-0-140-236.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: payload-processing
    serviceAccountName: payload-processing
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - configMap:
        defaultMode: 420
        name: payload-processing-plugins
      name: plugins-config-volume
    - name: kube-api-access-5d6fl
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:04Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:03Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:15Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:15Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:03Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 25m
        memory: 32Mi
      containerID: cri-o://00920c0d80c8d582174345011afb523fe6987f40dceb99d11fac36573c60e13f
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imageID: quay.io/opendatahub/odh-praxis-extproc@sha256:8b7084478cc266b2373bbfb04190ed3ca6fe759428663bddbab63b9c3ad8f130
      lastState: {}
      name: payload-pre-processing
      ready: true
      resources:
        limits:
          cpu: 200m
          memory: 128Mi
        requests:
          cpu: 25m
          memory: 32Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T15:08:03Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000240000
          uid: 1000240000
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-5d6fl
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.140.236
    hostIPs:
    - ip: 10.0.140.236
    observedGeneration: 1
    phase: Running
    podIP: 10.133.1.73
    podIPs:
    - ip: 10.133.1.73
    qosClass: Burstable
    startTime: "2026-11-02T15:08:03Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      ai-gateway-controller.opendatahub.io/extproc-config-sha256: 99ace36d4344145336ff0f3775d60adc6a6a229dce78cfb8312208868aea25e9
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.1.192/23"],"mac_address":"0a:58:0a:84:01:c0","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.1.192/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.1.192"
            ],
            "mac": "0a:58:0a:84:01:c0",
            "default": true,
            "dns": {}
        }]
      kubectl.kubernetes.io/restartedAt: "2026-11-02T15:08:02Z"
      openshift.io/scc: restricted-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-11-02T15:08:02Z"
    generateName: payload-processing-699c65dd57-
    generation: 1
    labels:
      app: payload-processing
      app.kubernetes.io/managed-by: ai-gateway-controller
      maas.opendatahub.io/tenant-instance: payload-processing
      pod-template-hash: 699c65dd57
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T15:08:02Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:ai-gateway-controller.opendatahub.io/extproc-config-sha256: {}
            f:kubectl.kubernetes.io/restartedAt: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/managed-by: {}
            f:maas.opendatahub.io/tenant-instance: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"3af8cd92-be0d-44b2-8e7a-b509dea3e436"}: {}
        f:spec:
          f:containers:
            k:{"name":"payload-processing"}:
              .: {}
              f:args: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:lifecycle:
                .: {}
                f:preStop:
                  .: {}
                  f:sleep:
                    .: {}
                    f:seconds: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:tcpSocket:
                  .: {}
                  f:port: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9004,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9090,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":50052,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:grpc:
                  .: {}
                  f:port: {}
                  f:service: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:limits:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
                f:runAsNonRoot: {}
                f:seccompProfile:
                  .: {}
                  f:type: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/praxis"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"plugins-config-volume"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
              f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T15:08:02Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T15:08:03Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.1.192"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T15:08:15Z"
    name: payload-processing-699c65dd57-f5zxl
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: payload-processing-699c65dd57
      uid: 3af8cd92-be0d-44b2-8e7a-b509dea3e436
    resourceVersion: "195532"
    uid: 4b0ae7b7-881d-4f6f-92df-7e5536bbeff9
  spec:
    containers:
    - args:
      - -c
      - /etc/praxis/extproc.yaml
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imagePullPolicy: IfNotPresent
      lifecycle:
        preStop:
          sleep:
            seconds: 5
      livenessProbe:
        failureThreshold: 3
        initialDelaySeconds: 15
        periodSeconds: 20
        successThreshold: 1
        tcpSocket:
          port: health
        timeoutSeconds: 1
      name: payload-processing
      ports:
      - containerPort: 9004
        name: grpc
        protocol: TCP
      - containerPort: 50052
        name: health
        protocol: TCP
      - containerPort: 9090
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        grpc:
          port: 50052
          service: envoy.service.ext_proc.v3.ExternalProcessor
        initialDelaySeconds: 5
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 64Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000240000
        seccompProfile:
          type: RuntimeDefault
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-d4bcr
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    imagePullSecrets:
    - name: payload-processing-dockercfg-964jt
    nodeName: ip-10-0-139-26.ec2.internal
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c16,c0
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: payload-processing
    serviceAccountName: payload-processing
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    volumes:
    - configMap:
        defaultMode: 420
        name: payload-processing-plugins
      name: plugins-config-volume
    - name: kube-api-access-d4bcr
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:04Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:02Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:15Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:15Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T15:08:02Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 50m
        memory: 64Mi
      containerID: cri-o://dcbcde5234865a44f7faf404c92b0eddaf8566dc99a1e126225a93a05dc01fc3
      image: quay.io/opendatahub/odh-praxis-extproc:odh-stable
      imageID: quay.io/opendatahub/odh-praxis-extproc@sha256:8b7084478cc266b2373bbfb04190ed3ca6fe759428663bddbab63b9c3ad8f130
      lastState: {}
      name: payload-processing
      ready: true
      resources:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 64Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T15:08:03Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000240000
          uid: 1000240000
      volumeMounts:
      - mountPath: /etc/praxis
        name: plugins-config-volume
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-d4bcr
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.1.192
    podIPs:
    - ip: 10.132.1.192
    qosClass: Burstable
    startTime: "2026-11-02T15:08:02Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.19/23"],"mac_address":"0a:58:0a:84:00:13","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.19/23","gateway_ip":"10.132.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.132.0.19"
            ],
            "mac": "0a:58:0a:84:00:13",
            "default": true,
            "dns": {}
        }]
      openshift.io/required-scc: restricted
      openshift.io/scc: restricted
      security.openshift.io/validated-scc-subject-type: serviceaccount
    creationTimestamp: "2026-11-02T13:37:38Z"
    generateName: router-default-5466575dd5-
    generation: 1
    labels:
      ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
      ingresscontroller.operator.openshift.io/hash: 6975dbd7f4
      pod-template-hash: 5466575dd5
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:openshift.io/required-scc: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:ingresscontroller.operator.openshift.io/deployment-ingresscontroller: {}
            f:ingresscontroller.operator.openshift.io/hash: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"7f002b8c-2aa2-40c6-a395-3d4b941e1487"}: {}
        f:spec:
          f:affinity:
            .: {}
            f:nodeAffinity:
              .: {}
              f:requiredDuringSchedulingIgnoredDuringExecution: {}
          f:containers:
            k:{"name":"router"}:
              .: {}
              f:env:
                .: {}
                k:{"name":"DEFAULT_CERTIFICATE_DIR"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"DEFAULT_DESTINATION_CA_PATH"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"RELOAD_INTERVAL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_ALLOW_WILDCARD_ROUTES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CANONICAL_HOSTNAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CIPHERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CIPHERSUITES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_CURVES"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DISABLE_HTTP2"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_DOMAIN"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_ENABLE_EXTERNAL_CERTIFICATE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_LOAD_BALANCE_ALGORITHM"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_CERT_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_CIPHERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_KEY_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TLS_MIN_VERSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_METRICS_TYPE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SERVICE_NAME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SERVICE_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_SET_FORWARDED_HEADERS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_TCP_BALANCE_SCHEME"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_THREADS"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"ROUTER_USE_PROXY_PROTOCOL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"SSL_MIN_VERSION"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_PASSWORD_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_PORT"}:
                  .: {}
                  f:name: {}
                  f:value: {}
                k:{"name":"STATS_USERNAME_FILE"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:terminationGracePeriodSeconds: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":80,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":443,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":1936,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:readOnlyRootFilesystem: {}
              f:startupProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/etc/pki/tls/metrics-certs"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/etc/pki/tls/private"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/lib/haproxy/conf/metrics-auth"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
                k:{"mountPath":"/var/run/configmaps/service-ca"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:topologySpreadConstraints:
            .: {}
            k:{"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"ScheduleAnyway"}:
              .: {}
              f:labelSelector: {}
              f:maxSkew: {}
              f:topologyKey: {}
              f:whenUnsatisfiable: {}
          f:volumes:
            .: {}
            k:{"name":"default-certificate"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"metrics-certs"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
            k:{"name":"service-ca-bundle"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:items: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"stats-auth"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-11-02T13:37:38Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            .: {}
            k:{"type":"PodScheduled"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:message: {}
              f:reason: {}
              f:status: {}
              f:type: {}
      manager: kube-scheduler
      operation: Update
      subresource: status
      time: "2026-11-02T13:42:54Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-139-26
      operation: Update
      subresource: status
      time: "2026-11-02T13:43:18Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-11-02T13:43:38Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.132.0.19"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-11-02T13:43:41Z"
    name: router-default-5466575dd5-gsvt5
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: router-default-5466575dd5
      uid: 7f002b8c-2aa2-40c6-a395-3d4b941e1487
    resourceVersion: "6675"
    uid: d861fac3-737a-4cd7-abc6-4af75b4c1d67
  spec:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: node.openshift.io/remote-worker
              operator: NotIn
              values:
              - ""
    containers:
    - env:
      - name: DEFAULT_CERTIFICATE_DIR
        value: /etc/pki/tls/private
      - name: DEFAULT_DESTINATION_CA_PATH
        value: /var/run/configmaps/service-ca/service-ca.crt
      - name: RELOAD_INTERVAL
        value: 5s
      - name: ROUTER_ALLOW_WILDCARD_ROUTES
        value: "false"
      - name: ROUTER_CANONICAL_HOSTNAME
        value: router-default.apps.59ad8915e5dac481f8f4.prod.konflux-ocp-ci.dev
      - name: ROUTER_CIPHERS
        value: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
      - name: ROUTER_CIPHERSUITES
        value: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
      - name: ROUTER_CURVES
        value: X25519MLKEM768:X25519:P-256:P-384:P-521
      - name: ROUTER_DISABLE_HTTP2
        value: "true"
      - name: ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK
        value: "false"
      - name: ROUTER_DOMAIN
        value: apps.59ad8915e5dac481f8f4.prod.konflux-ocp-ci.dev
      - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE
        value: "true"
      - name: ROUTER_LOAD_BALANCE_ALGORITHM
        value: random
      - name: ROUTER_METRICS_TLS_CERT_FILE
        value: /etc/pki/tls/metrics-certs/tls.crt
      - name: ROUTER_METRICS_TLS_CIPHERS
        value: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
      - name: ROUTER_METRICS_TLS_KEY_FILE
        value: /etc/pki/tls/metrics-certs/tls.key
      - name: ROUTER_METRICS_TLS_MIN_VERSION
        value: VersionTLS12
      - name: ROUTER_METRICS_TYPE
        value: haproxy
      - name: ROUTER_SERVICE_NAME
        value: default
      - name: ROUTER_SERVICE_NAMESPACE
        value: openshift-ingress
      - name: ROUTER_SET_FORWARDED_HEADERS
        value: append
      - name: ROUTER_TCP_BALANCE_SCHEME
        value: source
      - name: ROUTER_THREADS
        value: "4"
      - name: ROUTER_USE_PROXY_PROTOCOL
        value: "true"
      - name: SSL_MIN_VERSION
        value: TLSv1.2
      - name: STATS_PASSWORD_FILE
        value: /var/lib/haproxy/conf/metrics-auth/statsPassword
      - name: STATS_PORT
        value: "1936"
      - name: STATS_USERNAME_FILE
        value: /var/lib/haproxy/conf/metrics-auth/statsUsername
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a679d80eb36ca7db888d4fbd1fdf16b0997a7c7a107936396b7a57d8b199f4e
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz
          port: 1936
          scheme: HTTP
        periodSeconds: 10
        successThreshold: 1
        terminationGracePeriodSeconds: 10
        timeoutSeconds: 1
      name: router
      ports:
      - containerPort: 80
        name: http
        protocol: TCP
      - containerPort: 443
        name: https
        protocol: TCP
      - containerPort: 1936
        name: metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz/ready
          port: 1936
          scheme: HTTP
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
      securityContext:
        allowPrivilegeEscalation: true
        capabilities:
          drop:
          - KILL
          - MKNOD
          - SETGID
          - SETUID
        readOnlyRootFilesystem: false
        runAsNonRoot: true
        runAsUser: 1000240000
      startupProbe:
        failureThreshold: 120
        httpGet:
          path: /healthz/ready
          port: 1936
          scheme: HTTP
        periodSeconds: 1
        successThreshold: 1
        timeoutSeconds: 1
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /etc/pki/tls/private
        name: default-certificate
        readOnly: true
      - mountPath: /var/run/configmaps/service-ca
        name: service-ca-bundle
        readOnly: true
      - mountPath: /var/lib/haproxy/conf/metrics-auth
        name: stats-auth
        readOnly: true
      - mountPath: /etc/pki/tls/metrics-certs
        name: metrics-certs
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-5xskc
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: true
    nodeName: ip-10-0-139-26.ec2.internal
    nodeSelector:
      kubernetes.io/os: linux
      node-role.kubernetes.io/worker: ""
    preemptionPolicy: PreemptLowerPriority
    priority: 2000000000
    priorityClassName: system-cluster-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000240000
      seLinuxOptions:
        level: s0:c16,c0
    serviceAccount: router
    serviceAccountName: router
    terminationGracePeriodSeconds: 3600
    tolerations:
    - effect: NoExecute
      key: kubernetes.io/e2e-evict-taint-key
      operator: Equal
      value: evictTaintVal
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists
    topologySpreadConstraints:
    - labelSelector:
        matchExpressions:
        - key: ingresscontroller.operator.openshift.io/hash
          operator: In
          values:
          - 6975dbd7f4
      maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: ScheduleAnyway
    volumes:
    - name: default-certificate
      secret:
        defaultMode: 420
        secretName: default-ingress-cert
    - configMap:
        defaultMode: 420
        items:
        - key: service-ca.crt
          path: service-ca.crt
        name: service-ca-bundle
        optional: false
      name: service-ca-bundle
    - name: stats-auth
      secret:
        defaultMode: 420
        secretName: router-stats-default
    - name: metrics-certs
      secret:
        defaultMode: 420
        secretName: router-metrics-certs-default
    - name: kube-api-access-5xskc
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:43:39Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:43:18Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:43:41Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:43:41Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-11-02T13:43:18Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - allocatedResources:
        cpu: 100m
        memory: 256Mi
      containerID: cri-o://74484cc09676d5fc2f3bf66debdec5c30d4c351dbac4e195138e653f3c7aea58
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a679d80eb36ca7db888d4fbd1fdf16b0997a7c7a107936396b7a57d8b199f4e
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a679d80eb36ca7db888d4fbd1fdf16b0997a7c7a107936396b7a57d8b199f4e
      lastState: {}
      name: router
      ready: true
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-11-02T13:43:38Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000240000
          uid: 1000240000
      volumeMounts:
      - mountPath: /etc/pki/tls/private
        name: default-certificate
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/configmaps/service-ca
        name: service-ca-bundle
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/lib/haproxy/conf/metrics-auth
        name: stats-auth
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /etc/pki/tls/metrics-certs
        name: metrics-certs
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-5xskc
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.139.26
    hostIPs:
    - ip: 10.0.139.26
    observedGeneration: 1
    phase: Running
    podIP: 10.132.0.19
    podIPs:
    - ip: 10.132.0.19
    qosClass: Burstable
    startTime: "2026-11-02T13:43:18Z"
kind: PodList
metadata:
  resourceVersion: "211567"