---
apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.20/23"],"mac_address":"0a:58:0a:85:00:14","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.20/23","gateway_ip":"10.133.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.133.0.20"
            ],
            "mac": "0a:58:0a:85:00:14",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /metrics
      prometheus.io/port: "9402"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-30T08:58:39Z"
    generateName: cert-manager-597b95cb84-
    generation: 1
    labels:
      app: cert-manager
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: cert-manager
      app.kubernetes.io/version: v1.20.4
      pod-template-hash: 597b95cb84
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-135-148
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:39Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"9f1bb26f-af76-4056-859b-34b7dca75329"}: {}
        f:spec:
          f:containers:
            k:{"name":"cert-manager-controller"}:
              .: {}
              f:args: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9402,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9403,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/var/run/secrets/openshift/serviceaccount"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"bound-sa-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-30T08:58:39Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:40Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.133.0.20"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:44Z"
    name: cert-manager-597b95cb84-s5f8l
    namespace: cert-manager
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: cert-manager-597b95cb84
      uid: 9f1bb26f-af76-4056-859b-34b7dca75329
    resourceVersion: "14807"
    uid: d227c135-8213-44da-aaf7-79834b4a1c63
  spec:
    containers:
    - args:
      - --acme-http01-solver-image=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:8ce8e3f21e49fda94f6c984e4777637e3773a099c6d74010a26e5e2743965739
      - --cluster-resource-namespace=$(POD_NAMESPACE)
      - --feature-gates=ACMEHTTP01IngressPathTypeExact=false
      - --leader-election-namespace=kube-system
      - --max-concurrent-challenges=60
      - --v=2
      command:
      - /app/cmd/controller/controller
      env:
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 8
        httpGet:
          path: /livez
          port: http-healthz
          scheme: HTTP
        initialDelaySeconds: 10
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 15
      name: cert-manager-controller
      ports:
      - containerPort: 9402
        name: http-metrics
        protocol: TCP
      - containerPort: 9403
        name: http-healthz
        protocol: TCP
      resources: {}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000660000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-h6lgq
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: false
    imagePullSecrets:
    - name: cert-manager-dockercfg-g5nzv
    nodeName: ip-10-0-135-148.ec2.internal
    nodeSelector:
      kubernetes.io/os: linux
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000660000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c26,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: cert-manager
    serviceAccountName: cert-manager
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    volumes:
    - name: bound-sa-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: openshift
            expirationSeconds: 3600
            path: token
    - name: kube-api-access-h6lgq
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:44Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:39Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:44Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:44Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:39Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://ab0b5668a57fb3bec16121ed3321a0e151eae892401a76d3dbf575ecbc14dab9
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      imageID: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      lastState: {}
      name: cert-manager-controller
      ready: true
      resources: {}
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-30T08:58:43Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000660000
          uid: 1000660000
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-h6lgq
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.135.148
    hostIPs:
    - ip: 10.0.135.148
    observedGeneration: 1
    phase: Running
    podIP: 10.133.0.20
    podIPs:
    - ip: 10.133.0.20
    qosClass: BestEffort
    startTime: "2026-10-30T08:58:39Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.27/23"],"mac_address":"0a:58:0a:86:00:1b","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.27/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.27"
            ],
            "mac": "0a:58:0a:86:00:1b",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /metrics
      prometheus.io/port: "9402"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-30T08:58:31Z"
    generateName: cert-manager-cainjector-5c57bbd4fc-
    generation: 1
    labels:
      app: cainjector
      app.kubernetes.io/component: cainjector
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: cainjector
      app.kubernetes.io/version: v1.20.4
      pod-template-hash: 5c57bbd4fc
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-30
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:31Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"4f823bb7-4f0b-4188-a9f9-583db3ee01d7"}: {}
        f:spec:
          f:containers:
            k:{"name":"cert-manager-cainjector"}:
              .: {}
              f:args: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9402,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/var/run/secrets/openshift/serviceaccount"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"bound-sa-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-30T08:58:31Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:32Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.27"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:37Z"
    name: cert-manager-cainjector-5c57bbd4fc-dzc7k
    namespace: cert-manager
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: cert-manager-cainjector-5c57bbd4fc
      uid: 4f823bb7-4f0b-4188-a9f9-583db3ee01d7
    resourceVersion: "14060"
    uid: efd3e3ba-d6ac-4eea-b95a-d55e389327d8
  spec:
    containers:
    - args:
      - --leader-election-namespace=kube-system
      - --v=2
      command:
      - /app/cmd/cainjector/cainjector
      env:
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      imagePullPolicy: IfNotPresent
      name: cert-manager-cainjector
      ports:
      - containerPort: 9402
        name: http-metrics
        protocol: TCP
      resources: {}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000660000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-tdnvd
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: false
    imagePullSecrets:
    - name: cert-manager-cainjector-dockercfg-wtgnj
    nodeName: ip-10-0-138-30.ec2.internal
    nodeSelector:
      kubernetes.io/os: linux
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000660000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c26,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: cert-manager-cainjector
    serviceAccountName: cert-manager-cainjector
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    volumes:
    - name: bound-sa-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: openshift
            expirationSeconds: 3600
            path: token
    - name: kube-api-access-tdnvd
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:36Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:31Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:36Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:36Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:31Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://75463b6b665336323769fa9fff956738a8f1d526596b783a82e1804457f5bef4
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      imageID: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      lastState: {}
      name: cert-manager-cainjector
      ready: true
      resources: {}
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-30T08:58:36Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000660000
          uid: 1000660000
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-tdnvd
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.30
    hostIPs:
    - ip: 10.0.138.30
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.27
    podIPs:
    - ip: 10.134.0.27
    qosClass: BestEffort
    startTime: "2026-10-30T08:58:31Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.28/23"],"mac_address":"0a:58:0a:86:00:1c","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.28/23","gateway_ip":"10.134.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.134.0.28"
            ],
            "mac": "0a:58:0a:86:00:1c",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /metrics
      prometheus.io/port: "9402"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
      security.openshift.io/validated-scc-subject-type: user
    creationTimestamp: "2026-10-30T08:58:31Z"
    generateName: cert-manager-webhook-5dbbbf75cc-
    generation: 1
    labels:
      app: webhook
      app.kubernetes.io/component: webhook
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: webhook
      app.kubernetes.io/version: v1.20.4
      pod-template-hash: 5dbbbf75cc
      topology.kubernetes.io/region: us-east-1
      topology.kubernetes.io/zone: us-east-1a
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: ip-10-0-138-30
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:31Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"9b790a95-0566-4023-96b6-71999b61d58a"}: {}
        f:spec:
          f:containers:
            k:{"name":"cert-manager-webhook"}:
              .: {}
              f:args: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":6080,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9402,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":10250,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/var/run/secrets/openshift/serviceaccount"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"bound-sa-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
      manager: kube-controller-manager
      operation: Update
      time: "2026-10-30T08:58:31Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:32Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodScheduled"}:
              f:observedGeneration: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:observedGeneration: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:observedGeneration: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.134.0.28"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2026-10-30T08:58:44Z"
    name: cert-manager-webhook-5dbbbf75cc-kxkcr
    namespace: cert-manager
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: cert-manager-webhook-5dbbbf75cc
      uid: 9b790a95-0566-4023-96b6-71999b61d58a
    resourceVersion: "14800"
    uid: 07ad0359-8b96-4263-8677-19cde4b78505
  spec:
    containers:
    - args:
      - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
      - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
      - --dynamic-serving-dns-names=cert-manager-webhook,cert-manager-webhook.$(POD_NAMESPACE),cert-manager-webhook.$(POD_NAMESPACE).svc
      - --secure-port=10250
      - --v=2
      command:
      - /app/cmd/webhook/webhook
      env:
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 3
        httpGet:
          path: /livez
          port: healthcheck
          scheme: HTTP
        initialDelaySeconds: 60
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      name: cert-manager-webhook
      ports:
      - containerPort: 10250
        name: https
        protocol: TCP
      - containerPort: 6080
        name: healthcheck
        protocol: TCP
      - containerPort: 9402
        name: http-metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz
          port: healthcheck
          scheme: HTTP
        initialDelaySeconds: 5
        periodSeconds: 5
        successThreshold: 1
        timeoutSeconds: 1
      resources: {}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000660000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-czxrv
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: false
    imagePullSecrets:
    - name: cert-manager-webhook-dockercfg-klpkz
    nodeName: ip-10-0-138-30.ec2.internal
    nodeSelector:
      kubernetes.io/os: linux
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000660000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c26,c5
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: cert-manager-webhook
    serviceAccountName: cert-manager-webhook
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    volumes:
    - name: bound-sa-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: openshift
            expirationSeconds: 3600
            path: token
    - name: kube-api-access-czxrv
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:36Z"
      observedGeneration: 1
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:31Z"
      observedGeneration: 1
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:43Z"
      observedGeneration: 1
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:43Z"
      observedGeneration: 1
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2026-10-30T08:58:31Z"
      observedGeneration: 1
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://336cdfb52bca56eba2eae8533215a1ae5aaa472d3bd5b7244403d18d26088bd4
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      imageID: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:b3305a06bff4a344ba1b19c8142d7e605fc723841981c97aab2310ff8a82c66d
      lastState: {}
      name: cert-manager-webhook
      ready: true
      resources: {}
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2026-10-30T08:58:36Z"
      user:
        linux:
          gid: 0
          supplementalGroups:
          - 0
          - 1000660000
          uid: 1000660000
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-czxrv
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.0.138.30
    hostIPs:
    - ip: 10.0.138.30
    observedGeneration: 1
    phase: Running
    podIP: 10.134.0.28
    podIPs:
    - ip: 10.134.0.28
    qosClass: BestEffort
    startTime: "2026-10-30T08:58:31Z"
kind: PodList
metadata:
  resourceVersion: "34078"