I0428 12:58:05.155847 1 cmd.go:253] Using service-serving-cert provided certificates I0428 12:58:05.156093 1 leaderelection.go:121] The leader election gives 4 retries and allows for 30s of clock skew. The kube-apiserver downtime tolerance is 78s. Worst non-graceful lease acquisition is 2m43s. Worst graceful lease acquisition is {26s}. I0428 12:58:05.157099 1 observer_polling.go:159] Starting file observer I0428 12:58:05.157277 1 builder.go:304] openshift-controller-manager version 4.20.0-202512150315.p2.gd9e543d.assembly.stream.el9-d9e543d-d9e543dd31e981f279c447e4f92f0dac3f665f9e I0428 12:58:05.157898 1 dynamic_serving_content.go:116] "Loaded a new cert/key pair" name="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" I0428 12:58:05.732384 1 requestheader_controller.go:255] Loaded a new request header values for RequestHeaderAuthRequestController I0428 12:58:05.739388 1 maxinflight.go:139] "Initialized nonMutatingChan" len=400 I0428 12:58:05.739406 1 maxinflight.go:145] "Initialized mutatingChan" len=200 I0428 12:58:05.739427 1 maxinflight.go:116] "Set denominator for readonly requests" limit=400 I0428 12:58:05.739432 1 maxinflight.go:120] "Set denominator for mutating requests" limit=200 I0428 12:58:05.743633 1 secure_serving.go:57] Forcing use of http/1.1 only W0428 12:58:05.743653 1 secure_serving.go:69] Use of insecure cipher 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256' detected. W0428 12:58:05.743659 1 secure_serving.go:69] Use of insecure cipher 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256' detected. W0428 12:58:05.743664 1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_128_GCM_SHA256' detected. W0428 12:58:05.743668 1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_256_GCM_SHA384' detected. W0428 12:58:05.743671 1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_128_CBC_SHA' detected. W0428 12:58:05.743674 1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_256_CBC_SHA' detected. I0428 12:58:05.743727 1 genericapiserver.go:546] MuxAndDiscoveryComplete has all endpoints registered and discovery information is complete I0428 12:58:05.747466 1 leaderelection.go:257] attempting to acquire leader lease openshift-controller-manager/openshift-master-controllers... I0428 12:58:05.748373 1 requestheader_controller.go:180] Starting RequestHeaderAuthRequestController I0428 12:58:05.748429 1 configmap_cafile_content.go:205] "Starting controller" name="client-ca::kube-system::extension-apiserver-authentication::client-ca-file" I0428 12:58:05.748460 1 shared_informer.go:350] "Waiting for caches to sync" controller="client-ca::kube-system::extension-apiserver-authentication::client-ca-file" I0428 12:58:05.748437 1 shared_informer.go:350] "Waiting for caches to sync" controller="RequestHeaderAuthRequestController" I0428 12:58:05.748628 1 configmap_cafile_content.go:205] "Starting controller" name="client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" I0428 12:58:05.748668 1 shared_informer.go:350] "Waiting for caches to sync" controller="client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" I0428 12:58:05.748749 1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"controller-manager.openshift-controller-manager.svc\" [serving] validServingFor=[controller-manager.openshift-controller-manager.svc,controller-manager.openshift-controller-manager.svc.cluster.local] issuer=\"openshift-service-serving-signer@1777378979\" (2026-04-28 12:23:06 +0000 UTC to 2028-04-27 12:23:07 +0000 UTC (now=2026-04-28 12:58:05.748709834 +0000 UTC))" I0428 12:58:05.749017 1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1777381085\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1777381085\" (2026-04-28 11:58:05 +0000 UTC to 2029-04-28 11:58:05 +0000 UTC (now=2026-04-28 12:58:05.748998402 +0000 UTC))" I0428 12:58:05.749114 1 secure_serving.go:211] Serving securely on [::]:8443 I0428 12:58:05.749151 1 genericapiserver.go:696] [graceful-termination] waiting for shutdown to be initiated I0428 12:58:05.749183 1 dynamic_serving_content.go:135] "Starting controller" name="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" I0428 12:58:05.749282 1 tlsconfig.go:243] "Starting DynamicServingCertificateController" I0428 12:58:05.749981 1 reflector.go:430] "Caches populated" type="*v1.ConfigMap" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" I0428 12:58:05.750225 1 reflector.go:430] "Caches populated" type="*v1.ConfigMap" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" I0428 12:58:05.750335 1 reflector.go:430] "Caches populated" type="*v1.ConfigMap" reflector="k8s.io/client-go@v0.33.2/tools/cache/reflector.go:285" I0428 12:58:05.849568 1 shared_informer.go:357] "Caches are synced" controller="client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" I0428 12:58:05.849883 1 shared_informer.go:357] "Caches are synced" controller="client-ca::kube-system::extension-apiserver-authentication::client-ca-file" I0428 12:58:05.850096 1 shared_informer.go:357] "Caches are synced" controller="RequestHeaderAuthRequestController" I0428 12:58:05.850270 1 tlsconfig.go:181] "Loaded client CA" index=0 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"aggregator-signer\" [] issuer=\"\" (2026-04-28 12:06:06 +0000 UTC to 2026-04-29 12:06:06 +0000 UTC (now=2026-04-28 12:58:05.850243838 +0000 UTC))" I0428 12:58:05.850583 1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"controller-manager.openshift-controller-manager.svc\" [serving] validServingFor=[controller-manager.openshift-controller-manager.svc,controller-manager.openshift-controller-manager.svc.cluster.local] issuer=\"openshift-service-serving-signer@1777378979\" (2026-04-28 12:23:06 +0000 UTC to 2028-04-27 12:23:07 +0000 UTC (now=2026-04-28 12:58:05.850564556 +0000 UTC))" I0428 12:58:05.850838 1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1777381085\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1777381085\" (2026-04-28 11:58:05 +0000 UTC to 2029-04-28 11:58:05 +0000 UTC (now=2026-04-28 12:58:05.850814376 +0000 UTC))" I0428 12:58:05.851019 1 tlsconfig.go:181] "Loaded client CA" index=0 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"admin-kubeconfig-signer\" [] issuer=\"\" (2026-04-28 12:06:03 +0000 UTC to 2036-04-25 12:06:03 +0000 UTC (now=2026-04-28 12:58:05.851004373 +0000 UTC))" I0428 12:58:05.851081 1 tlsconfig.go:181] "Loaded client CA" index=1 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kubelet-signer\" [] issuer=\"\" (2026-04-28 12:06:08 +0000 UTC to 2026-04-29 12:06:08 +0000 UTC (now=2026-04-28 12:58:05.851067899 +0000 UTC))" I0428 12:58:05.851109 1 tlsconfig.go:181] "Loaded client CA" index=2 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-control-plane-signer\" [] issuer=\"\" (2026-04-28 12:06:09 +0000 UTC to 2027-04-28 12:06:09 +0000 UTC (now=2026-04-28 12:58:05.851098907 +0000 UTC))" I0428 12:58:05.851138 1 tlsconfig.go:181] "Loaded client CA" index=3 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-apiserver-to-kubelet-signer\" [] issuer=\"\" (2026-04-28 12:06:09 +0000 UTC to 2027-04-28 12:06:09 +0000 UTC (now=2026-04-28 12:58:05.851126894 +0000 UTC))" I0428 12:58:05.851174 1 tlsconfig.go:181] "Loaded client CA" index=4 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kubelet-bootstrap-kubeconfig-signer\" [] issuer=\"\" (2026-04-28 12:06:04 +0000 UTC to 2036-04-25 12:06:04 +0000 UTC (now=2026-04-28 12:58:05.85115534 +0000 UTC))" I0428 12:58:05.851209 1 tlsconfig.go:181] "Loaded client CA" index=5 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-csr-signer_@1777378976\" [] issuer=\"kubelet-signer\" (2026-04-28 12:22:56 +0000 UTC to 2026-04-29 12:06:09 +0000 UTC (now=2026-04-28 12:58:05.851193389 +0000 UTC))" I0428 12:58:05.851239 1 tlsconfig.go:181] "Loaded client CA" index=6 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"openshift-kube-apiserver-operator_node-system-admin-signer@1777378980\" [] issuer=\"\" (2026-04-28 12:22:59 +0000 UTC to 2029-04-27 12:23:00 +0000 UTC (now=2026-04-28 12:58:05.851226974 +0000 UTC))" I0428 12:58:05.851271 1 tlsconfig.go:181] "Loaded client CA" index=7 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"aggregator-signer\" [] issuer=\"\" (2026-04-28 12:06:06 +0000 UTC to 2026-04-29 12:06:06 +0000 UTC (now=2026-04-28 12:58:05.851258998 +0000 UTC))" I0428 12:58:05.851524 1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"controller-manager.openshift-controller-manager.svc\" [serving] validServingFor=[controller-manager.openshift-controller-manager.svc,controller-manager.openshift-controller-manager.svc.cluster.local] issuer=\"openshift-service-serving-signer@1777378979\" (2026-04-28 12:23:06 +0000 UTC to 2028-04-27 12:23:07 +0000 UTC (now=2026-04-28 12:58:05.851507668 +0000 UTC))" I0428 12:58:05.851757 1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1777381085\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1777381085\" (2026-04-28 11:58:05 +0000 UTC to 2029-04-28 11:58:05 +0000 UTC (now=2026-04-28 12:58:05.85173653 +0000 UTC))"