I0428 12:58:03.044791       1 cmd.go:253] Using service-serving-cert provided certificates
I0428 12:58:03.045024       1 leaderelection.go:121] The leader election gives 4 retries and allows for 30s of clock skew. The kube-apiserver downtime tolerance is 78s. Worst non-graceful lease acquisition is 2m43s. Worst graceful lease acquisition is {26s}.
I0428 12:58:03.045387       1 observer_polling.go:159] Starting file observer
I0428 12:58:03.045831       1 builder.go:304] openshift-controller-manager version 4.20.0-202512150315.p2.gd9e543d.assembly.stream.el9-d9e543d-d9e543dd31e981f279c447e4f92f0dac3f665f9e
I0428 12:58:03.046368       1 dynamic_serving_content.go:116] "Loaded a new cert/key pair" name="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key"
I0428 12:58:03.653896       1 requestheader_controller.go:255] Loaded a new request header values for RequestHeaderAuthRequestController
I0428 12:58:03.657389       1 maxinflight.go:139] "Initialized nonMutatingChan" len=400
I0428 12:58:03.657408       1 maxinflight.go:145] "Initialized mutatingChan" len=200
I0428 12:58:03.657427       1 maxinflight.go:116] "Set denominator for readonly requests" limit=400
I0428 12:58:03.657431       1 maxinflight.go:120] "Set denominator for mutating requests" limit=200
I0428 12:58:03.660001       1 secure_serving.go:57] Forcing use of http/1.1 only
I0428 12:58:03.660015       1 genericapiserver.go:546] MuxAndDiscoveryComplete has all endpoints registered and discovery information is complete
W0428 12:58:03.660022       1 secure_serving.go:69] Use of insecure cipher 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256' detected.
W0428 12:58:03.660027       1 secure_serving.go:69] Use of insecure cipher 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256' detected.
W0428 12:58:03.660031       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_128_GCM_SHA256' detected.
W0428 12:58:03.660033       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_256_GCM_SHA384' detected.
W0428 12:58:03.660036       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_128_CBC_SHA' detected.
W0428 12:58:03.660039       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_256_CBC_SHA' detected.
I0428 12:58:03.663843       1 requestheader_controller.go:180] Starting RequestHeaderAuthRequestController
I0428 12:58:03.663884       1 configmap_cafile_content.go:205] "Starting controller" name="client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file"
I0428 12:58:03.663958       1 shared_informer.go:350] "Waiting for caches to sync" controller="client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file"
I0428 12:58:03.663865       1 configmap_cafile_content.go:205] "Starting controller" name="client-ca::kube-system::extension-apiserver-authentication::client-ca-file"
I0428 12:58:03.664026       1 shared_informer.go:350] "Waiting for caches to sync" controller="client-ca::kube-system::extension-apiserver-authentication::client-ca-file"
I0428 12:58:03.663922       1 shared_informer.go:350] "Waiting for caches to sync" controller="RequestHeaderAuthRequestController"
I0428 12:58:03.664350       1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"controller-manager.openshift-controller-manager.svc\" [serving] validServingFor=[controller-manager.openshift-controller-manager.svc,controller-manager.openshift-controller-manager.svc.cluster.local] issuer=\"openshift-service-serving-signer@1777378979\" (2026-04-28 12:23:06 +0000 UTC to 2028-04-27 12:23:07 +0000 UTC (now=2026-04-28 12:58:03.664318059 +0000 UTC))"
I0428 12:58:03.664381       1 dynamic_serving_content.go:135] "Starting controller" name="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key"
I0428 12:58:03.664583       1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1777381083\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1777381083\" (2026-04-28 11:58:03 +0000 UTC to 2029-04-28 11:58:03 +0000 UTC (now=2026-04-28 12:58:03.664560177 +0000 UTC))"
I0428 12:58:03.664613       1 secure_serving.go:211] Serving securely on [::]:8443
I0428 12:58:03.664632       1 genericapiserver.go:696] [graceful-termination] waiting for shutdown to be initiated
I0428 12:58:03.664645       1 tlsconfig.go:243] "Starting DynamicServingCertificateController"
I0428 12:58:03.664738       1 leaderelection.go:257] attempting to acquire leader lease openshift-controller-manager/openshift-master-controllers...
I0428 12:58:03.665397       1 reflector.go:430] "Caches populated" type="*v1.ConfigMap" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285"
I0428 12:58:03.665892       1 reflector.go:430] "Caches populated" type="*v1.ConfigMap" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285"
I0428 12:58:03.666168       1 reflector.go:430] "Caches populated" type="*v1.ConfigMap" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285"
I0428 12:58:03.764331       1 shared_informer.go:357] "Caches are synced" controller="client-ca::kube-system::extension-apiserver-authentication::client-ca-file"
I0428 12:58:03.764521       1 shared_informer.go:357] "Caches are synced" controller="RequestHeaderAuthRequestController"
I0428 12:58:03.765045       1 tlsconfig.go:181] "Loaded client CA" index=0 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"admin-kubeconfig-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:03 +0000 UTC to 2036-04-25 12:06:03 +0000 UTC (now=2026-04-28 12:58:03.765014148 +0000 UTC))"
I0428 12:58:03.765119       1 tlsconfig.go:181] "Loaded client CA" index=1 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kubelet-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:08 +0000 UTC to 2026-04-29 12:06:08 +0000 UTC (now=2026-04-28 12:58:03.765101768 +0000 UTC))"
I0428 12:58:03.765226       1 tlsconfig.go:181] "Loaded client CA" index=2 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-control-plane-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:09 +0000 UTC to 2027-04-28 12:06:09 +0000 UTC (now=2026-04-28 12:58:03.765212101 +0000 UTC))"
I0428 12:58:03.765263       1 tlsconfig.go:181] "Loaded client CA" index=3 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-apiserver-to-kubelet-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:09 +0000 UTC to 2027-04-28 12:06:09 +0000 UTC (now=2026-04-28 12:58:03.765252339 +0000 UTC))"
I0428 12:58:03.765313       1 tlsconfig.go:181] "Loaded client CA" index=4 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kubelet-bootstrap-kubeconfig-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:04 +0000 UTC to 2036-04-25 12:06:04 +0000 UTC (now=2026-04-28 12:58:03.765301872 +0000 UTC))"
I0428 12:58:03.765342       1 tlsconfig.go:181] "Loaded client CA" index=5 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-csr-signer_@1777378976\" [] issuer=\"kubelet-signer\" (2026-04-28 12:22:56 +0000 UTC to 2026-04-29 12:06:09 +0000 UTC (now=2026-04-28 12:58:03.765331216 +0000 UTC))"
I0428 12:58:03.765388       1 tlsconfig.go:181] "Loaded client CA" index=6 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"openshift-kube-apiserver-operator_node-system-admin-signer@1777378980\" [] issuer=\"<self>\" (2026-04-28 12:22:59 +0000 UTC to 2029-04-27 12:23:00 +0000 UTC (now=2026-04-28 12:58:03.765360546 +0000 UTC))"
I0428 12:58:03.765707       1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"controller-manager.openshift-controller-manager.svc\" [serving] validServingFor=[controller-manager.openshift-controller-manager.svc,controller-manager.openshift-controller-manager.svc.cluster.local] issuer=\"openshift-service-serving-signer@1777378979\" (2026-04-28 12:23:06 +0000 UTC to 2028-04-27 12:23:07 +0000 UTC (now=2026-04-28 12:58:03.765687441 +0000 UTC))"
I0428 12:58:03.766049       1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1777381083\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1777381083\" (2026-04-28 11:58:03 +0000 UTC to 2029-04-28 11:58:03 +0000 UTC (now=2026-04-28 12:58:03.76603127 +0000 UTC))"
I0428 12:58:03.766111       1 shared_informer.go:357] "Caches are synced" controller="client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file"
I0428 12:58:03.766416       1 tlsconfig.go:181] "Loaded client CA" index=0 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"admin-kubeconfig-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:03 +0000 UTC to 2036-04-25 12:06:03 +0000 UTC (now=2026-04-28 12:58:03.766396267 +0000 UTC))"
I0428 12:58:03.766455       1 tlsconfig.go:181] "Loaded client CA" index=1 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kubelet-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:08 +0000 UTC to 2026-04-29 12:06:08 +0000 UTC (now=2026-04-28 12:58:03.766441524 +0000 UTC))"
I0428 12:58:03.766514       1 tlsconfig.go:181] "Loaded client CA" index=2 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-control-plane-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:09 +0000 UTC to 2027-04-28 12:06:09 +0000 UTC (now=2026-04-28 12:58:03.766493305 +0000 UTC))"
I0428 12:58:03.766546       1 tlsconfig.go:181] "Loaded client CA" index=3 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-apiserver-to-kubelet-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:09 +0000 UTC to 2027-04-28 12:06:09 +0000 UTC (now=2026-04-28 12:58:03.766534369 +0000 UTC))"
I0428 12:58:03.766589       1 tlsconfig.go:181] "Loaded client CA" index=4 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kubelet-bootstrap-kubeconfig-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:04 +0000 UTC to 2036-04-25 12:06:04 +0000 UTC (now=2026-04-28 12:58:03.76657739 +0000 UTC))"
I0428 12:58:03.766670       1 tlsconfig.go:181] "Loaded client CA" index=5 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-csr-signer_@1777378976\" [] issuer=\"kubelet-signer\" (2026-04-28 12:22:56 +0000 UTC to 2026-04-29 12:06:09 +0000 UTC (now=2026-04-28 12:58:03.766608542 +0000 UTC))"
I0428 12:58:03.766702       1 tlsconfig.go:181] "Loaded client CA" index=6 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"openshift-kube-apiserver-operator_node-system-admin-signer@1777378980\" [] issuer=\"<self>\" (2026-04-28 12:22:59 +0000 UTC to 2029-04-27 12:23:00 +0000 UTC (now=2026-04-28 12:58:03.766689214 +0000 UTC))"
I0428 12:58:03.766742       1 tlsconfig.go:181] "Loaded client CA" index=7 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"aggregator-signer\" [] issuer=\"<self>\" (2026-04-28 12:06:06 +0000 UTC to 2026-04-29 12:06:06 +0000 UTC (now=2026-04-28 12:58:03.766731249 +0000 UTC))"
I0428 12:58:03.767078       1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"controller-manager.openshift-controller-manager.svc\" [serving] validServingFor=[controller-manager.openshift-controller-manager.svc,controller-manager.openshift-controller-manager.svc.cluster.local] issuer=\"openshift-service-serving-signer@1777378979\" (2026-04-28 12:23:06 +0000 UTC to 2028-04-27 12:23:07 +0000 UTC (now=2026-04-28 12:58:03.767058285 +0000 UTC))"
I0428 12:58:03.767391       1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1777381083\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1777381083\" (2026-04-28 11:58:03 +0000 UTC to 2029-04-28 11:58:03 +0000 UTC (now=2026-04-28 12:58:03.767375416 +0000 UTC))"