---
apiVersion: apps/v1
items:
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
    creationTimestamp: "2026-07-28T20:13:57Z"
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-name: data-science-gateway
      pod-template-hash: 68cf4d799c
      service.istio.io/canonical-name: data-science-gateway-data-science-gateway-class
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"47309f11-04d5-4e3a-bfa2-07188d94a744"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:istio.io/rev: {}
                f:prometheus.io/path: {}
                f:prometheus.io/port: {}
                f:prometheus.io/scrape: {}
              f:labels:
                .: {}
                f:gateway.istio.io/managed: {}
                f:gateway.networking.k8s.io/gateway-name: {}
                f:pod-template-hash: {}
                f:service.istio.io/canonical-name: {}
                f:service.istio.io/canonical-revision: {}
                f:sidecar.istio.io/inject: {}
            f:spec:
              f:containers:
                k:{"name":"istio-proxy"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"CA_ADDR"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GOMAXPROCS"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"GOMEMLIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"HOST_IP"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"INSTANCE_IP"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"ISTIO_CPU_LIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                      .: {}
                      f:name: {}
                    k:{"name":"ISTIO_META_CLUSTER_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_MESH_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_NODE_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"ISTIO_META_OWNER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_POD_PORTS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CERT_PROVIDER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"PROXY_CONFIG"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICE_ACCOUNT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"TRUST_DOMAIN"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":15020,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15021,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15090,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:limits:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsGroup: {}
                    f:runAsNonRoot: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/istio/pod"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/etc/istio/proxy"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/lib/istio/data"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/credential-uds"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/istio"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/tokens"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:dnsPolicy: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext:
                .: {}
                f:sysctls: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:volumes:
                .: {}
                k:{"name":"credential-socket"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"istio-data"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"istio-envoy"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                  f:name: {}
                k:{"name":"istio-podinfo"}:
                  .: {}
                  f:downwardAPI:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                  f:name: {}
                k:{"name":"istio-token"}:
                  .: {}
                  f:name: {}
                  f:projected:
                    .: {}
                    f:defaultMode: {}
                    f:sources: {}
                k:{"name":"istiod-ca-cert"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"workload-certs"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"workload-socket"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:13:57Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:14:02Z"
    name: data-science-gateway-data-science-gateway-class-68cf4d799c
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: data-science-gateway-data-science-gateway-class
      uid: 47309f11-04d5-4e3a-bfa2-07188d94a744
    resourceVersion: "14963"
    uid: 9e59db62-5ea8-4938-a072-7e2352f5e19d
  spec:
    replicas: 1
    selector:
      matchLabels:
        gateway.networking.k8s.io/gateway-name: data-science-gateway
        pod-template-hash: 68cf4d799c
    template:
      metadata:
        annotations:
          istio.io/rev: openshift-gateway
          prometheus.io/path: /stats/prometheus
          prometheus.io/port: "15020"
          prometheus.io/scrape: "true"
        labels:
          gateway.istio.io/managed: istio.io-gateway-controller
          gateway.networking.k8s.io/gateway-name: data-science-gateway
          pod-template-hash: 68cf4d799c
          service.istio.io/canonical-name: data-science-gateway-data-science-gateway-class
          service.istio.io/canonical-revision: latest
          sidecar.istio.io/inject: "false"
      spec:
        containers:
        - args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.cluster.local
          - --proxyLogLevel
          - warning
          - --proxyComponentLogLevel
          - misc:error
          - --log_output_level
          - default:info
          env:
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: CA_ADDR
            value: istiod-openshift-gateway.openshift-ingress.svc:15012
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: HOST_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.hostIP
          - name: ISTIO_CPU_LIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.cpu
          - name: PROXY_CONFIG
            value: |
              {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
          - name: ISTIO_META_POD_PORTS
            value: '[]'
          - name: ISTIO_META_APP_CONTAINERS
          - name: GOMEMLIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.memory
          - name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.cpu
          - name: ISTIO_META_CLUSTER_ID
            value: Kubernetes
          - name: ISTIO_META_NODE_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
          - name: ISTIO_META_INTERCEPTION_MODE
            value: REDIRECT
          - name: ISTIO_META_WORKLOAD_NAME
            value: data-science-gateway-data-science-gateway-class
          - name: ISTIO_META_OWNER
            value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/data-science-gateway-data-science-gateway-class
          - name: ISTIO_META_MESH_ID
            value: cluster.local
          - name: TRUST_DOMAIN
            value: cluster.local
          image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:2b5f5aa5ee9974269d8e3666b1bfc58da10c172bf3f1d6defd555fbd1ac9a6ec
          imagePullPolicy: IfNotPresent
          name: istio-proxy
          ports:
          - containerPort: 15020
            name: metrics
            protocol: TCP
          - containerPort: 15021
            name: status-port
            protocol: TCP
          - containerPort: 15090
            name: http-envoy-prom
            protocol: TCP
          readinessProbe:
            failureThreshold: 4
            httpGet:
              path: /healthz/ready
              port: 15021
              scheme: HTTP
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              cpu: "2"
              memory: 1Gi
            requests:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 1000329999
            runAsNonRoot: true
            runAsUser: 1000329999
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15021
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/run/secrets/workload-spiffe-uds
            name: workload-socket
          - mountPath: /var/run/secrets/credential-uds
            name: credential-socket
          - mountPath: /var/run/secrets/workload-spiffe-credentials
            name: workload-certs
          - mountPath: /var/run/secrets/istio
            name: istiod-ca-cert
          - mountPath: /var/lib/istio/data
            name: istio-data
          - mountPath: /etc/istio/proxy
            name: istio-envoy
          - mountPath: /var/run/secrets/tokens
            name: istio-token
          - mountPath: /etc/istio/pod
            name: istio-podinfo
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext:
          sysctls:
          - name: net.ipv4.ip_unprivileged_port_start
            value: "0"
        serviceAccount: data-science-gateway-data-science-gateway-class
        serviceAccountName: data-science-gateway-data-science-gateway-class
        terminationGracePeriodSeconds: 30
        volumes:
        - emptyDir: {}
          name: workload-socket
        - emptyDir: {}
          name: credential-socket
        - emptyDir: {}
          name: workload-certs
        - emptyDir:
            medium: Memory
          name: istio-envoy
        - emptyDir: {}
          name: istio-data
        - downwardAPI:
            defaultMode: 420
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.labels
              path: labels
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.annotations
              path: annotations
          name: istio-podinfo
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: istio-ca
                expirationSeconds: 43200
                path: istio-token
        - configMap:
            defaultMode: 420
            name: openshift-gw-ca-root-cert
          name: istiod-ca-cert
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "2"
      meta.helm.sh/release-name: openshift-gateway-istiod
      meta.helm.sh/release-namespace: openshift-ingress
    creationTimestamp: "2026-07-28T20:13:58Z"
    generation: 1
    labels:
      app: istiod
      app.kubernetes.io/instance: openshift-gateway-istiod
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: istiod
      app.kubernetes.io/part-of: istio
      app.kubernetes.io/version: 1.27.8
      helm.sh/chart: istiod-1.27.8
      istio: istiod
      istio.io/dataplane-mode: none
      istio.io/rev: openshift-gateway
      operator.istio.io/component: Pilot
      pod-template-hash: 5677ccb49b
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
            f:istio: {}
            f:istio.io/dataplane-mode: {}
            f:istio.io/rev: {}
            f:operator.istio.io/component: {}
            f:pod-template-hash: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ff4ce72e-2b82-41b8-b1d3-1a9e8ae9ab19"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:prometheus.io/port: {}
                f:prometheus.io/scrape: {}
                f:sidecar.istio.io/inject: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:app: {}
                f:app.kubernetes.io/instance: {}
                f:app.kubernetes.io/managed-by: {}
                f:app.kubernetes.io/name: {}
                f:app.kubernetes.io/part-of: {}
                f:app.kubernetes.io/version: {}
                f:helm.sh/chart: {}
                f:istio: {}
                f:istio.io/dataplane-mode: {}
                f:istio.io/rev: {}
                f:operator.istio.io/component: {}
                f:pod-template-hash: {}
                f:sidecar.istio.io/inject: {}
            f:spec:
              f:containers:
                k:{"name":"discovery"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"CA_TRUSTED_NODE_ACCOUNTS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"CLUSTER_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ENABLE_GATEWAY_API_INFERENCE_EXTENSION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GOMAXPROCS"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"GOMEMLIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"KUBECONFIG"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CA_CERT_CONFIGMAP"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CERT_PROVIDER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ALPHA_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ANALYSIS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_STATUS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_CONTROLLER_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_TRACE_SAMPLING"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PLATFORM"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"REVISION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICE_ACCOUNT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"X_PILOT_IGNORE_RESOURCES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"X_PILOT_INCLUDE_RESOURCES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8080,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15010,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15012,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15014,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15017,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsNonRoot: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/cacerts"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istio-dns"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/istiod/ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istiod/tls"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/remote"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/tokens"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
              f:dnsPolicy: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"cacerts"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-csr-ca-configmap"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"istio-csr-dns-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-kubeconfig"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-token"}:
                  .: {}
                  f:name: {}
                  f:projected:
                    .: {}
                    f:defaultMode: {}
                    f:sources: {}
                k:{"name":"local-certs"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:13:58Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:14:03Z"
    name: istiod-openshift-gateway-5677ccb49b
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: istiod-openshift-gateway
      uid: ff4ce72e-2b82-41b8-b1d3-1a9e8ae9ab19
    resourceVersion: "14984"
    uid: 7da7e64e-3413-48cb-8217-4c60e6657370
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: istiod
        istio.io/rev: openshift-gateway
        pod-template-hash: 5677ccb49b
    template:
      metadata:
        annotations:
          prometheus.io/port: "15014"
          prometheus.io/scrape: "true"
          sidecar.istio.io/inject: "false"
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        labels:
          app: istiod
          app.kubernetes.io/instance: openshift-gateway-istiod
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: istiod
          app.kubernetes.io/part-of: istio
          app.kubernetes.io/version: 1.27.8
          helm.sh/chart: istiod-1.27.8
          istio: istiod
          istio.io/dataplane-mode: none
          istio.io/rev: openshift-gateway
          operator.istio.io/component: Pilot
          pod-template-hash: 5677ccb49b
          sidecar.istio.io/inject: "false"
      spec:
        containers:
        - args:
          - discovery
          - --monitoringAddr=:15014
          - --log_output_level=default:info
          - --domain
          - cluster.local
          - --keepaliveMaxServerConnectionAge
          - 30m
          env:
          - name: REVISION
            value: openshift-gateway
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: KUBECONFIG
            value: /var/run/secrets/remote/config
          - name: CA_TRUSTED_NODE_ACCOUNTS
            value: kube-system/ztunnel
          - name: ENABLE_GATEWAY_API_INFERENCE_EXTENSION
            value: "true"
          - name: ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
            value: "false"
          - name: PILOT_ENABLE_ALPHA_GATEWAY_API
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_STATUS
            value: "true"
          - name: PILOT_GATEWAY_API_CONTROLLER_NAME
            value: openshift.io/gateway-controller/v1
          - name: PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME
            value: openshift-default
          - name: PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API
            value: "false"
          - name: X_PILOT_IGNORE_RESOURCES
            value: '*.istio.io'
          - name: X_PILOT_INCLUDE_RESOURCES
            value: wasmplugins.extensions.istio.io,envoyfilters.networking.istio.io,destinationrules.networking.istio.io
          - name: PILOT_TRACE_SAMPLING
            value: "1"
          - name: PILOT_CA_CERT_CONFIGMAP
            value: openshift-gw-ca-root-cert
          - name: PILOT_ENABLE_ANALYSIS
            value: "false"
          - name: CLUSTER_ID
            value: Kubernetes
          - name: GOMEMLIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.memory
          - name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.cpu
          - name: PLATFORM
            value: openshift
          image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:2a25d47b4bb3bf346563a0ccea986c0ab0466709ca4cb9d2666ba6a02a8a5f31
          imagePullPolicy: IfNotPresent
          name: discovery
          ports:
          - containerPort: 8080
            name: http-debug
            protocol: TCP
          - containerPort: 15010
            name: grpc-xds
            protocol: TCP
          - containerPort: 15012
            name: tls-xds
            protocol: TCP
          - containerPort: 15017
            name: https-webhooks
            protocol: TCP
          - containerPort: 15014
            name: http-monitoring
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 500m
              memory: 2Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/run/secrets/tokens
            name: istio-token
            readOnly: true
          - mountPath: /var/run/secrets/istio-dns
            name: local-certs
          - mountPath: /etc/cacerts
            name: cacerts
            readOnly: true
          - mountPath: /var/run/secrets/remote
            name: istio-kubeconfig
            readOnly: true
          - mountPath: /var/run/secrets/istiod/tls
            name: istio-csr-dns-cert
            readOnly: true
          - mountPath: /var/run/secrets/istiod/ca
            name: istio-csr-ca-configmap
            readOnly: true
        dnsPolicy: ClusterFirst
        priorityClassName: system-cluster-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: istiod-openshift-gateway
        serviceAccountName: istiod-openshift-gateway
        terminationGracePeriodSeconds: 30
        tolerations:
        - key: cni.istio.io/not-ready
          operator: Exists
        volumes:
        - emptyDir:
            medium: Memory
          name: local-certs
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: istio-ca
                expirationSeconds: 43200
                path: istio-token
        - name: cacerts
          secret:
            defaultMode: 420
            optional: true
            secretName: cacerts
        - name: istio-kubeconfig
          secret:
            defaultMode: 420
            optional: true
            secretName: istio-kubeconfig
        - name: istio-csr-dns-cert
          secret:
            defaultMode: 420
            optional: true
            secretName: istiod-tls
        - configMap:
            defaultMode: 420
            name: openshift-gw-ca-root-cert
            optional: true
          name: istio-csr-ca-configmap
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
      meta.helm.sh/release-name: openshift-gateway-istiod
      meta.helm.sh/release-namespace: openshift-ingress
    creationTimestamp: "2026-07-28T20:13:50Z"
    generation: 2
    labels:
      app: istiod
      app.kubernetes.io/instance: openshift-gateway-istiod
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: istiod
      app.kubernetes.io/part-of: istio
      app.kubernetes.io/version: 1.27.8
      helm.sh/chart: istiod-1.27.8
      istio: istiod
      istio.io/dataplane-mode: none
      istio.io/rev: openshift-gateway
      operator.istio.io/component: Pilot
      pod-template-hash: 7b7995d5cd
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:app.kubernetes.io/version: {}
            f:helm.sh/chart: {}
            f:istio: {}
            f:istio.io/dataplane-mode: {}
            f:istio.io/rev: {}
            f:operator.istio.io/component: {}
            f:pod-template-hash: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ff4ce72e-2b82-41b8-b1d3-1a9e8ae9ab19"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:prometheus.io/port: {}
                f:prometheus.io/scrape: {}
                f:sidecar.istio.io/inject: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:app: {}
                f:app.kubernetes.io/instance: {}
                f:app.kubernetes.io/managed-by: {}
                f:app.kubernetes.io/name: {}
                f:app.kubernetes.io/part-of: {}
                f:app.kubernetes.io/version: {}
                f:helm.sh/chart: {}
                f:istio: {}
                f:istio.io/dataplane-mode: {}
                f:istio.io/rev: {}
                f:operator.istio.io/component: {}
                f:pod-template-hash: {}
                f:sidecar.istio.io/inject: {}
            f:spec:
              f:containers:
                k:{"name":"discovery"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"CA_TRUSTED_NODE_ACCOUNTS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"CLUSTER_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GOMAXPROCS"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"GOMEMLIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"KUBECONFIG"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CA_CERT_CONFIGMAP"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CERT_PROVIDER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ALPHA_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_ANALYSIS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_ENABLE_GATEWAY_API_STATUS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_CONTROLLER_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_TRACE_SAMPLING"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PLATFORM"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"REVISION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICE_ACCOUNT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"X_PILOT_IGNORE_RESOURCES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"X_PILOT_INCLUDE_RESOURCES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8080,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15010,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15012,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15014,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15017,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsNonRoot: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/cacerts"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istio-dns"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/istiod/ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/istiod/tls"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/remote"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/secrets/tokens"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
              f:dnsPolicy: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"cacerts"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-csr-ca-configmap"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"istio-csr-dns-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-kubeconfig"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"istio-token"}:
                  .: {}
                  f:name: {}
                  f:projected:
                    .: {}
                    f:defaultMode: {}
                    f:sources: {}
                k:{"name":"local-certs"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:14:03Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:observedGeneration: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:14:03Z"
    name: istiod-openshift-gateway-7b7995d5cd
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: istiod-openshift-gateway
      uid: ff4ce72e-2b82-41b8-b1d3-1a9e8ae9ab19
    resourceVersion: "14999"
    uid: 9aa97657-184f-4ad9-bb63-8417c545d494
  spec:
    replicas: 0
    selector:
      matchLabels:
        app: istiod
        istio.io/rev: openshift-gateway
        pod-template-hash: 7b7995d5cd
    template:
      metadata:
        annotations:
          prometheus.io/port: "15014"
          prometheus.io/scrape: "true"
          sidecar.istio.io/inject: "false"
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        labels:
          app: istiod
          app.kubernetes.io/instance: openshift-gateway-istiod
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: istiod
          app.kubernetes.io/part-of: istio
          app.kubernetes.io/version: 1.27.8
          helm.sh/chart: istiod-1.27.8
          istio: istiod
          istio.io/dataplane-mode: none
          istio.io/rev: openshift-gateway
          operator.istio.io/component: Pilot
          pod-template-hash: 7b7995d5cd
          sidecar.istio.io/inject: "false"
      spec:
        containers:
        - args:
          - discovery
          - --monitoringAddr=:15014
          - --log_output_level=default:info
          - --domain
          - cluster.local
          - --keepaliveMaxServerConnectionAge
          - 30m
          env:
          - name: REVISION
            value: openshift-gateway
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: KUBECONFIG
            value: /var/run/secrets/remote/config
          - name: CA_TRUSTED_NODE_ACCOUNTS
            value: kube-system/ztunnel
          - name: ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
            value: "false"
          - name: PILOT_ENABLE_ALPHA_GATEWAY_API
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER
            value: "true"
          - name: PILOT_ENABLE_GATEWAY_API_GATEWAYCLASS_CONTROLLER
            value: "false"
          - name: PILOT_ENABLE_GATEWAY_API_STATUS
            value: "true"
          - name: PILOT_GATEWAY_API_CONTROLLER_NAME
            value: openshift.io/gateway-controller/v1
          - name: PILOT_GATEWAY_API_DEFAULT_GATEWAYCLASS_NAME
            value: openshift-default
          - name: PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API
            value: "false"
          - name: X_PILOT_IGNORE_RESOURCES
            value: '*.istio.io'
          - name: X_PILOT_INCLUDE_RESOURCES
            value: wasmplugins.extensions.istio.io,envoyfilters.networking.istio.io,destinationrules.networking.istio.io
          - name: PILOT_TRACE_SAMPLING
            value: "1"
          - name: PILOT_CA_CERT_CONFIGMAP
            value: openshift-gw-ca-root-cert
          - name: PILOT_ENABLE_ANALYSIS
            value: "false"
          - name: CLUSTER_ID
            value: Kubernetes
          - name: GOMEMLIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.memory
          - name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.cpu
          - name: PLATFORM
            value: openshift
          image: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:2a25d47b4bb3bf346563a0ccea986c0ab0466709ca4cb9d2666ba6a02a8a5f31
          imagePullPolicy: IfNotPresent
          name: discovery
          ports:
          - containerPort: 8080
            name: http-debug
            protocol: TCP
          - containerPort: 15010
            name: grpc-xds
            protocol: TCP
          - containerPort: 15012
            name: tls-xds
            protocol: TCP
          - containerPort: 15017
            name: https-webhooks
            protocol: TCP
          - containerPort: 15014
            name: http-monitoring
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 500m
              memory: 2Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/run/secrets/tokens
            name: istio-token
            readOnly: true
          - mountPath: /var/run/secrets/istio-dns
            name: local-certs
          - mountPath: /etc/cacerts
            name: cacerts
            readOnly: true
          - mountPath: /var/run/secrets/remote
            name: istio-kubeconfig
            readOnly: true
          - mountPath: /var/run/secrets/istiod/tls
            name: istio-csr-dns-cert
            readOnly: true
          - mountPath: /var/run/secrets/istiod/ca
            name: istio-csr-ca-configmap
            readOnly: true
        dnsPolicy: ClusterFirst
        priorityClassName: system-cluster-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: istiod-openshift-gateway
        serviceAccountName: istiod-openshift-gateway
        terminationGracePeriodSeconds: 30
        tolerations:
        - key: cni.istio.io/not-ready
          operator: Exists
        volumes:
        - emptyDir:
            medium: Memory
          name: local-certs
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: istio-ca
                expirationSeconds: 43200
                path: istio-token
        - name: cacerts
          secret:
            defaultMode: 420
            optional: true
            secretName: cacerts
        - name: istio-kubeconfig
          secret:
            defaultMode: 420
            optional: true
            secretName: istio-kubeconfig
        - name: istio-csr-dns-cert
          secret:
            defaultMode: 420
            optional: true
            secretName: istiod-tls
        - configMap:
            defaultMode: 420
            name: openshift-gw-ca-root-cert
            optional: true
          name: istio-csr-ca-configmap
  status:
    observedGeneration: 2
    replicas: 0
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "2"
      deployment.kubernetes.io/max-replicas: "3"
      deployment.kubernetes.io/revision: "1"
      platform.opendatahub.io/instance.generation: "2"
      platform.opendatahub.io/instance.name: default-gateway
      platform.opendatahub.io/instance.uid: 69c96721-fbf0-4110-b84f-07956dedb873
      platform.opendatahub.io/type: Open Data Hub
      platform.opendatahub.io/version: 3.5.0-ea.2
    creationTimestamp: "2026-07-28T20:13:48Z"
    generation: 1
    labels:
      app: kube-auth-proxy
      app.kubernetes.io/component: authentication
      pod-template-hash: 5bb564c89
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:13:56Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:platform.opendatahub.io/instance.generation: {}
            f:platform.opendatahub.io/instance.name: {}
            f:platform.opendatahub.io/instance.uid: {}
            f:platform.opendatahub.io/type: {}
            f:platform.opendatahub.io/version: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"6d81c1da-5c5a-465c-b55d-5f4de814d2b5"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:opendatahub.io/secret-hash: {}
              f:labels:
                .: {}
                f:app: {}
                f:app.kubernetes.io/component: {}
                f:pod-template-hash: {}
            f:spec:
              f:containers:
                k:{"name":"kube-auth-proxy"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"OAUTH2_PROXY_CLIENT_ID"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:secretKeyRef: {}
                    k:{"name":"OAUTH2_PROXY_CLIENT_SECRET"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:secretKeyRef: {}
                    k:{"name":"OAUTH2_PROXY_COOKIE_SECRET"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:secretKeyRef: {}
                    k:{"name":"PROXY_MODE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":4180,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":9000,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:limits:
                      .: {}
                      f:memory: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:readOnlyRootFilesystem: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/tls/private"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/tmp"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:dnsPolicy: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext:
                .: {}
                f:runAsNonRoot: {}
                f:seccompProfile:
                  .: {}
                  f:type: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:volumes:
                .: {}
                k:{"name":"tls-certs"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"tmp"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                    f:sizeLimit: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:13:57Z"
    name: kube-auth-proxy-5bb564c89
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: kube-auth-proxy
      uid: 6d81c1da-5c5a-465c-b55d-5f4de814d2b5
    resourceVersion: "14673"
    uid: 9994f727-f9ba-4924-a440-b9773337b815
  spec:
    replicas: 2
    selector:
      matchLabels:
        app: kube-auth-proxy
        pod-template-hash: 5bb564c89
    template:
      metadata:
        annotations:
          opendatahub.io/secret-hash: b5f90e4b7c88e9ed1c48ee00a94a6654efaa0590a936884947c7ac59a0b35c9b
        labels:
          app: kube-auth-proxy
          app.kubernetes.io/component: authentication
          pod-template-hash: 5bb564c89
      spec:
        containers:
        - args:
          - --http-address=0.0.0.0:4180
          - --https-address=0.0.0.0:8443
          - --metrics-address=0.0.0.0:9000
          - --email-domain=*
          - --upstream=static://200
          - --skip-provider-button
          - --skip-jwt-bearer-tokens=true
          - --pass-access-token=true
          - --set-xauthrequest=true
          - --enable-k8s-token-validation=true
          - --redirect-url=https://rh-ai.apps.3ee37661-348c-4043-9f1d-8bf147fec1da.prod.konfluxeaas.com/oauth2/callback
          - --tls-cert-file=/etc/tls/private/tls.crt
          - --tls-key-file=/etc/tls/private/tls.key
          - --use-system-trust-store=true
          - --cookie-expire=24h0m0s
          - --cookie-refresh=1h0m0s
          - --cookie-secure=true
          - --cookie-httponly=true
          - --cookie-samesite=lax
          - --cookie-name=_oauth2_proxy
          - --cookie-domain=rh-ai.apps.3ee37661-348c-4043-9f1d-8bf147fec1da.prod.konfluxeaas.com
          - --provider=openshift
          - --ssl-insecure-skip-verify=false
          - --scope=user:full
          env:
          - name: OAUTH2_PROXY_CLIENT_ID
            valueFrom:
              secretKeyRef:
                key: OAUTH2_PROXY_CLIENT_ID
                name: kube-auth-proxy-creds
          - name: OAUTH2_PROXY_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                key: OAUTH2_PROXY_CLIENT_SECRET
                name: kube-auth-proxy-creds
          - name: OAUTH2_PROXY_COOKIE_SECRET
            valueFrom:
              secretKeyRef:
                key: OAUTH2_PROXY_COOKIE_SECRET
                name: kube-auth-proxy-creds
          - name: PROXY_MODE
            value: auth
          image: quay.io/opendatahub/odh-kube-auth-proxy:v3.5.0-ea.2
          imagePullPolicy: IfNotPresent
          name: kube-auth-proxy
          ports:
          - containerPort: 4180
            name: http
            protocol: TCP
          - containerPort: 8443
            name: https
            protocol: TCP
          - containerPort: 9000
            name: metrics
            protocol: TCP
          resources:
            limits:
              memory: 128Mi
            requests:
              cpu: 500m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /etc/tls/private
            name: tls-certs
            readOnly: true
          - mountPath: /tmp
            name: tmp
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext:
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
        serviceAccount: kube-auth-proxy
        serviceAccountName: kube-auth-proxy
        terminationGracePeriodSeconds: 30
        volumes:
        - name: tls-certs
          secret:
            defaultMode: 420
            secretName: kube-auth-proxy-tls
        - emptyDir:
            medium: Memory
            sizeLimit: 10Mi
          name: tmp
  status:
    availableReplicas: 2
    fullyLabeledReplicas: 2
    observedGeneration: 1
    readyReplicas: 2
    replicas: 2
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
    creationTimestamp: "2026-07-28T20:16:42Z"
    generation: 1
    labels:
      gateway.istio.io/managed: istio.io-gateway-controller
      gateway.networking.k8s.io/gateway-name: maas-default-gateway
      pod-template-hash: 5ccb968c66
      service.istio.io/canonical-name: maas-default-gateway-openshift-default
      service.istio.io/canonical-revision: latest
      sidecar.istio.io/inject: "false"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
          f:labels:
            .: {}
            f:gateway.istio.io/managed: {}
            f:gateway.networking.k8s.io/gateway-name: {}
            f:pod-template-hash: {}
            f:service.istio.io/canonical-name: {}
            f:service.istio.io/canonical-revision: {}
            f:sidecar.istio.io/inject: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"cbd144f4-b938-40b4-9d74-20e68c60075c"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:istio.io/rev: {}
                f:prometheus.io/path: {}
                f:prometheus.io/port: {}
                f:prometheus.io/scrape: {}
              f:labels:
                .: {}
                f:gateway.istio.io/managed: {}
                f:gateway.networking.k8s.io/gateway-name: {}
                f:pod-template-hash: {}
                f:service.istio.io/canonical-name: {}
                f:service.istio.io/canonical-revision: {}
                f:sidecar.istio.io/inject: {}
            f:spec:
              f:containers:
                k:{"name":"istio-proxy"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"CA_ADDR"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GOMAXPROCS"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"GOMEMLIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"HOST_IP"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"INSTANCE_IP"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"ISTIO_CPU_LIMIT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:resourceFieldRef: {}
                    k:{"name":"ISTIO_META_APP_CONTAINERS"}:
                      .: {}
                      f:name: {}
                    k:{"name":"ISTIO_META_CLUSTER_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_INTERCEPTION_MODE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_MESH_ID"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_NODE_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"ISTIO_META_OWNER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_POD_PORTS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ISTIO_META_WORKLOAD_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"PILOT_CERT_PROVIDER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"PROXY_CONFIG"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICE_ACCOUNT"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"TRUST_DOMAIN"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":15020,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15021,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":15090,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:limits:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsGroup: {}
                    f:runAsNonRoot: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/istio/pod"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/etc/istio/proxy"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/lib/istio/data"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/credential-uds"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/istio"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/tokens"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/workload-spiffe-credentials"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/workload-spiffe-uds"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:dnsPolicy: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext:
                .: {}
                f:sysctls: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:volumes:
                .: {}
                k:{"name":"credential-socket"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"istio-data"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"istio-envoy"}:
                  .: {}
                  f:emptyDir:
                    .: {}
                    f:medium: {}
                  f:name: {}
                k:{"name":"istio-podinfo"}:
                  .: {}
                  f:downwardAPI:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                  f:name: {}
                k:{"name":"istio-token"}:
                  .: {}
                  f:name: {}
                  f:projected:
                    .: {}
                    f:defaultMode: {}
                    f:sources: {}
                k:{"name":"istiod-ca-cert"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"workload-certs"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
                k:{"name":"workload-socket"}:
                  .: {}
                  f:emptyDir: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:16:42Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:18:25Z"
    name: maas-default-gateway-openshift-default-5ccb968c66
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: maas-default-gateway-openshift-default
      uid: cbd144f4-b938-40b4-9d74-20e68c60075c
    resourceVersion: "22379"
    uid: b9b7dcd5-a236-4d49-974f-7eb9729deaa3
  spec:
    replicas: 1
    selector:
      matchLabels:
        gateway.networking.k8s.io/gateway-name: maas-default-gateway
        pod-template-hash: 5ccb968c66
    template:
      metadata:
        annotations:
          istio.io/rev: openshift-gateway
          prometheus.io/path: /stats/prometheus
          prometheus.io/port: "15020"
          prometheus.io/scrape: "true"
        labels:
          gateway.istio.io/managed: istio.io-gateway-controller
          gateway.networking.k8s.io/gateway-name: maas-default-gateway
          pod-template-hash: 5ccb968c66
          service.istio.io/canonical-name: maas-default-gateway-openshift-default
          service.istio.io/canonical-revision: latest
          sidecar.istio.io/inject: "false"
      spec:
        containers:
        - args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.cluster.local
          - --proxyLogLevel
          - warning
          - --proxyComponentLogLevel
          - misc:error
          - --log_output_level
          - default:info
          env:
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: CA_ADDR
            value: istiod-openshift-gateway.openshift-ingress.svc:15012
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: HOST_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.hostIP
          - name: ISTIO_CPU_LIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.cpu
          - name: PROXY_CONFIG
            value: |
              {"discoveryAddress":"istiod-openshift-gateway.openshift-ingress.svc:15012","proxyHeaders":{"server":{"disabled":true},"envoyDebugHeaders":{"disabled":true},"metadataExchangeHeaders":{"mode":"IN_MESH"}}}
          - name: ISTIO_META_POD_PORTS
            value: '[]'
          - name: ISTIO_META_APP_CONTAINERS
          - name: GOMEMLIMIT
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.memory
          - name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "0"
                resource: limits.cpu
          - name: ISTIO_META_CLUSTER_ID
            value: Kubernetes
          - name: ISTIO_META_NODE_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
          - name: ISTIO_META_INTERCEPTION_MODE
            value: REDIRECT
          - name: ISTIO_META_WORKLOAD_NAME
            value: maas-default-gateway-openshift-default
          - name: ISTIO_META_OWNER
            value: kubernetes://apis/apps/v1/namespaces/openshift-ingress/deployments/maas-default-gateway-openshift-default
          - name: ISTIO_META_MESH_ID
            value: cluster.local
          - name: TRUST_DOMAIN
            value: cluster.local
          image: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:2b5f5aa5ee9974269d8e3666b1bfc58da10c172bf3f1d6defd555fbd1ac9a6ec
          imagePullPolicy: IfNotPresent
          name: istio-proxy
          ports:
          - containerPort: 15020
            name: metrics
            protocol: TCP
          - containerPort: 15021
            name: status-port
            protocol: TCP
          - containerPort: 15090
            name: http-envoy-prom
            protocol: TCP
          readinessProbe:
            failureThreshold: 4
            httpGet:
              path: /healthz/ready
              port: 15021
              scheme: HTTP
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              cpu: "2"
              memory: 1Gi
            requests:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 1000329999
            runAsNonRoot: true
            runAsUser: 1000329999
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15021
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /var/run/secrets/workload-spiffe-uds
            name: workload-socket
          - mountPath: /var/run/secrets/credential-uds
            name: credential-socket
          - mountPath: /var/run/secrets/workload-spiffe-credentials
            name: workload-certs
          - mountPath: /var/run/secrets/istio
            name: istiod-ca-cert
          - mountPath: /var/lib/istio/data
            name: istio-data
          - mountPath: /etc/istio/proxy
            name: istio-envoy
          - mountPath: /var/run/secrets/tokens
            name: istio-token
          - mountPath: /etc/istio/pod
            name: istio-podinfo
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext:
          sysctls:
          - name: net.ipv4.ip_unprivileged_port_start
            value: "0"
        serviceAccount: maas-default-gateway-openshift-default
        serviceAccountName: maas-default-gateway-openshift-default
        terminationGracePeriodSeconds: 30
        volumes:
        - emptyDir: {}
          name: workload-socket
        - emptyDir: {}
          name: credential-socket
        - emptyDir: {}
          name: workload-certs
        - emptyDir:
            medium: Memory
          name: istio-envoy
        - emptyDir: {}
          name: istio-data
        - downwardAPI:
            defaultMode: 420
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.labels
              path: labels
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.annotations
              path: annotations
          name: istio-podinfo
        - name: istio-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: istio-ca
                expirationSeconds: 43200
                path: istio-token
        - configMap:
            defaultMode: 420
            name: openshift-gw-ca-root-cert
          name: istiod-ca-cert
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
    creationTimestamp: "2026-07-28T20:18:11Z"
    generation: 1
    labels:
      app: payload-pre-processing
      app.kubernetes.io/component: api
      app.kubernetes.io/name: maas-api
      app.kubernetes.io/part-of: models-as-a-service
      maas.opendatahub.io/tenant-instance: payload-pre-processing
      pod-template-hash: 687dbb6cf6
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:maas.opendatahub.io/tenant-instance: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"b689b688-2ffb-4bd4-84bb-768e2cd1bf1b"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:labels:
                .: {}
                f:app: {}
                f:app.kubernetes.io/component: {}
                f:app.kubernetes.io/name: {}
                f:app.kubernetes.io/part-of: {}
                f:maas.opendatahub.io/tenant-instance: {}
                f:pod-template-hash: {}
            f:spec:
              f:containers:
                k:{"name":"payload-pre-processing"}:
                  .: {}
                  f:args: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:tcpSocket:
                      .: {}
                      f:port: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":9004,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:tcpSocket:
                      .: {}
                      f:port: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:limits:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:readOnlyRootFilesystem: {}
                    f:seccompProfile:
                      .: {}
                      f:type: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:dnsPolicy: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext:
                .: {}
                f:runAsNonRoot: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:volumes:
                .: {}
                k:{"name":"plugins-config-volume"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:18:11Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:18:35Z"
    name: payload-pre-processing-687dbb6cf6
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: payload-pre-processing
      uid: b689b688-2ffb-4bd4-84bb-768e2cd1bf1b
    resourceVersion: "22594"
    uid: 3ffb27f6-d1b4-4aba-8a9e-77abf7b1c977
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: payload-pre-processing
        app.kubernetes.io/component: api
        app.kubernetes.io/name: maas-api
        app.kubernetes.io/part-of: models-as-a-service
        pod-template-hash: 687dbb6cf6
    template:
      metadata:
        labels:
          app: payload-pre-processing
          app.kubernetes.io/component: api
          app.kubernetes.io/name: maas-api
          app.kubernetes.io/part-of: models-as-a-service
          maas.opendatahub.io/tenant-instance: payload-pre-processing
          pod-template-hash: 687dbb6cf6
      spec:
        containers:
        - args:
          - --config-file
          - /config/custom-pre-processing-ipp-config.yaml
          - --v=3
          - --tracing=false
          image: quay.io/opendatahub/odh-ai-gateway-payload-processing:odh-stable
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 15
            periodSeconds: 20
            successThreshold: 1
            tcpSocket:
              port: grpc
            timeoutSeconds: 1
          name: payload-pre-processing
          ports:
          - containerPort: 9004
            name: grpc
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: grpc
            timeoutSeconds: 1
          resources:
            limits:
              cpu: 200m
              memory: 128Mi
            requests:
              cpu: 25m
              memory: 32Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            seccompProfile:
              type: RuntimeDefault
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /config
            name: plugins-config-volume
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext:
          runAsNonRoot: true
        serviceAccount: payload-processing
        serviceAccountName: payload-processing
        terminationGracePeriodSeconds: 30
        volumes:
        - configMap:
            defaultMode: 420
            name: payload-processing-plugins
          name: plugins-config-volume
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
    creationTimestamp: "2026-07-28T20:18:11Z"
    generation: 1
    labels:
      app: payload-processing
      app.kubernetes.io/component: api
      app.kubernetes.io/name: maas-api
      app.kubernetes.io/part-of: models-as-a-service
      maas.opendatahub.io/tenant-instance: payload-processing
      pod-template-hash: 5cc6cd444b
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:maas.opendatahub.io/tenant-instance: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"8f905507-04a4-479f-825d-f77935778720"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:labels:
                .: {}
                f:app: {}
                f:app.kubernetes.io/component: {}
                f:app.kubernetes.io/name: {}
                f:app.kubernetes.io/part-of: {}
                f:maas.opendatahub.io/tenant-instance: {}
                f:pod-template-hash: {}
            f:spec:
              f:containers:
                k:{"name":"payload-processing"}:
                  .: {}
                  f:args: {}
                  f:env:
                    .: {}
                    k:{"name":"GATEWAY_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"GATEWAY_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"TENANT_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:tcpSocket:
                      .: {}
                      f:port: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":9004,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":9005,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:tcpSocket:
                      .: {}
                      f:port: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:limits:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:capabilities:
                      .: {}
                      f:drop: {}
                    f:readOnlyRootFilesystem: {}
                    f:seccompProfile:
                      .: {}
                      f:type: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:dnsPolicy: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext:
                .: {}
                f:runAsNonRoot: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:volumes:
                .: {}
                k:{"name":"plugins-config-volume"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:18:11Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:18:25Z"
    name: payload-processing-5cc6cd444b
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: payload-processing
      uid: 8f905507-04a4-479f-825d-f77935778720
    resourceVersion: "22392"
    uid: 96eae896-bb6e-48e4-935b-bdd1a127d47d
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: payload-processing
        app.kubernetes.io/component: api
        app.kubernetes.io/name: maas-api
        app.kubernetes.io/part-of: models-as-a-service
        pod-template-hash: 5cc6cd444b
    template:
      metadata:
        labels:
          app: payload-processing
          app.kubernetes.io/component: api
          app.kubernetes.io/name: maas-api
          app.kubernetes.io/part-of: models-as-a-service
          maas.opendatahub.io/tenant-instance: payload-processing
          pod-template-hash: 5cc6cd444b
      spec:
        containers:
        - args:
          - --config-file
          - /config/custom-ipp-config.yaml
          - --v=3
          - --tracing=false
          env:
          - name: GATEWAY_NAMESPACE
            value: openshift-ingress
          - name: GATEWAY_NAME
            value: maas-default-gateway
          - name: TENANT_NAMESPACE
            value: models-as-a-service
          image: quay.io/opendatahub/odh-ai-gateway-payload-processing:odh-stable
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 15
            periodSeconds: 20
            successThreshold: 1
            tcpSocket:
              port: grpc
            timeoutSeconds: 1
          name: payload-processing
          ports:
          - containerPort: 9004
            name: grpc
            protocol: TCP
          - containerPort: 9005
            name: metrics
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: grpc
            timeoutSeconds: 1
          resources:
            limits:
              cpu: 500m
              memory: 256Mi
            requests:
              cpu: 50m
              memory: 64Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            seccompProfile:
              type: RuntimeDefault
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /config
            name: plugins-config-volume
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext:
          runAsNonRoot: true
        serviceAccount: payload-processing
        serviceAccountName: payload-processing
        terminationGracePeriodSeconds: 30
        volumes:
        - configMap:
            defaultMode: 420
            name: payload-processing-plugins
          name: plugins-config-volume
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "1"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
    creationTimestamp: "2026-07-28T20:02:18Z"
    generation: 1
    labels:
      ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
      ingresscontroller.operator.openshift.io/hash: 7bc5f8d78b
      pod-template-hash: 6b5458f665
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
          f:labels:
            .: {}
            f:ingresscontroller.operator.openshift.io/deployment-ingresscontroller: {}
            f:ingresscontroller.operator.openshift.io/hash: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"cc738d45-67e4-4e9e-88c1-ccdedda85672"}: {}
        f:spec:
          f:minReadySeconds: {}
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:ingresscontroller.operator.openshift.io/deployment-ingresscontroller: {}
                f:ingresscontroller.operator.openshift.io/hash: {}
                f:pod-template-hash: {}
            f:spec:
              f:affinity:
                .: {}
                f:nodeAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"router"}:
                  .: {}
                  f:env:
                    .: {}
                    k:{"name":"DEFAULT_CERTIFICATE_DIR"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"DEFAULT_DESTINATION_CA_PATH"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"RELOAD_INTERVAL"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_ALLOW_WILDCARD_ROUTES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_CANONICAL_HOSTNAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_CIPHERS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_CIPHERSUITES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_DISABLE_HTTP2"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_DOMAIN"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_ENABLE_EXTERNAL_CERTIFICATE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_LOAD_BALANCE_ALGORITHM"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_METRICS_TLS_CERT_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_METRICS_TLS_KEY_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_METRICS_TYPE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_SERVICE_NAME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_SERVICE_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_SET_FORWARDED_HEADERS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_TCP_BALANCE_SCHEME"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_THREADS"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"ROUTER_USE_PROXY_PROTOCOL"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SSL_MIN_VERSION"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"STATS_PASSWORD_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"STATS_PORT"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"STATS_USERNAME_FILE"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:terminationGracePeriodSeconds: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":80,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":1936,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:allowPrivilegeEscalation: {}
                    f:readOnlyRootFilesystem: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/pki/tls/metrics-certs"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/etc/pki/tls/private"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/lib/haproxy/conf/metrics-auth"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/run/configmaps/service-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
              f:dnsPolicy: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:topologySpreadConstraints:
                .: {}
                k:{"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"ScheduleAnyway"}:
                  .: {}
                  f:labelSelector: {}
                  f:maxSkew: {}
                  f:topologyKey: {}
                  f:whenUnsatisfiable: {}
              f:volumes:
                .: {}
                k:{"name":"default-certificate"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"metrics-certs"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"service-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"stats-auth"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-07-28T20:02:18Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2026-07-28T20:09:58Z"
    name: router-default-6b5458f665
    namespace: openshift-ingress
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: router-default
      uid: cc738d45-67e4-4e9e-88c1-ccdedda85672
    resourceVersion: "9543"
    uid: d364196d-10b5-4d45-a4d9-5cff3794f1a5
  spec:
    minReadySeconds: 30
    replicas: 1
    selector:
      matchLabels:
        ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
        pod-template-hash: 6b5458f665
    template:
      metadata:
        annotations:
          openshift.io/required-scc: restricted
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        labels:
          ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
          ingresscontroller.operator.openshift.io/hash: 7bc5f8d78b
          pod-template-hash: 6b5458f665
      spec:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: node.openshift.io/remote-worker
                  operator: NotIn
                  values:
                  - ""
        containers:
        - env:
          - name: DEFAULT_CERTIFICATE_DIR
            value: /etc/pki/tls/private
          - name: DEFAULT_DESTINATION_CA_PATH
            value: /var/run/configmaps/service-ca/service-ca.crt
          - name: RELOAD_INTERVAL
            value: 5s
          - name: ROUTER_ALLOW_WILDCARD_ROUTES
            value: "false"
          - name: ROUTER_CANONICAL_HOSTNAME
            value: router-default.apps.3ee37661-348c-4043-9f1d-8bf147fec1da.prod.konfluxeaas.com
          - name: ROUTER_CIPHERS
            value: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
          - name: ROUTER_CIPHERSUITES
            value: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
          - name: ROUTER_DISABLE_HTTP2
            value: "true"
          - name: ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK
            value: "false"
          - name: ROUTER_DOMAIN
            value: apps.3ee37661-348c-4043-9f1d-8bf147fec1da.prod.konfluxeaas.com
          - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE
            value: "true"
          - name: ROUTER_LOAD_BALANCE_ALGORITHM
            value: random
          - name: ROUTER_METRICS_TLS_CERT_FILE
            value: /etc/pki/tls/metrics-certs/tls.crt
          - name: ROUTER_METRICS_TLS_KEY_FILE
            value: /etc/pki/tls/metrics-certs/tls.key
          - name: ROUTER_METRICS_TYPE
            value: haproxy
          - name: ROUTER_SERVICE_NAME
            value: default
          - name: ROUTER_SERVICE_NAMESPACE
            value: openshift-ingress
          - name: ROUTER_SET_FORWARDED_HEADERS
            value: append
          - name: ROUTER_TCP_BALANCE_SCHEME
            value: source
          - name: ROUTER_THREADS
            value: "4"
          - name: ROUTER_USE_PROXY_PROTOCOL
            value: "true"
          - name: SSL_MIN_VERSION
            value: TLSv1.2
          - name: STATS_PASSWORD_FILE
            value: /var/lib/haproxy/conf/metrics-auth/statsPassword
          - name: STATS_PORT
            value: "1936"
          - name: STATS_USERNAME_FILE
            value: /var/lib/haproxy/conf/metrics-auth/statsUsername
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:924ddd9185690e32284b189b3d0c7f005f10029b713c963227fee4da98829559
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 1936
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            terminationGracePeriodSeconds: 10
            timeoutSeconds: 1
          name: router
          ports:
          - containerPort: 80
            name: http
            protocol: TCP
          - containerPort: 443
            name: https
            protocol: TCP
          - containerPort: 1936
            name: metrics
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz/ready
              port: 1936
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: true
            readOnlyRootFilesystem: false
          startupProbe:
            failureThreshold: 120
            httpGet:
              path: /healthz/ready
              port: 1936
              scheme: HTTP
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /etc/pki/tls/private
            name: default-certificate
            readOnly: true
          - mountPath: /var/run/configmaps/service-ca
            name: service-ca-bundle
            readOnly: true
          - mountPath: /var/lib/haproxy/conf/metrics-auth
            name: stats-auth
            readOnly: true
          - mountPath: /etc/pki/tls/metrics-certs
            name: metrics-certs
            readOnly: true
        dnsPolicy: ClusterFirst
        nodeSelector:
          kubernetes.io/os: linux
          node-role.kubernetes.io/worker: ""
        priorityClassName: system-cluster-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: router
        serviceAccountName: router
        terminationGracePeriodSeconds: 3600
        tolerations:
        - effect: NoExecute
          key: kubernetes.io/e2e-evict-taint-key
          operator: Equal
          value: evictTaintVal
        topologySpreadConstraints:
        - labelSelector:
            matchExpressions:
            - key: ingresscontroller.operator.openshift.io/hash
              operator: In
              values:
              - 7bc5f8d78b
          maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
        volumes:
        - name: default-certificate
          secret:
            defaultMode: 420
            secretName: default-ingress-cert
        - configMap:
            defaultMode: 420
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: service-ca-bundle
            optional: false
          name: service-ca-bundle
        - name: stats-auth
          secret:
            defaultMode: 420
            secretName: router-stats-default
        - name: metrics-certs
          secret:
            defaultMode: 420
            secretName: router-metrics-certs-default
  status:
    availableReplicas: 1
    fullyLabeledReplicas: 1
    observedGeneration: 1
    readyReplicas: 1
    replicas: 1
kind: ReplicaSetList
metadata:
  resourceVersion: "76134"