I0509 03:15:06.983014       1 cmd.go:253] Using service-serving-cert provided certificates
I0509 03:15:06.983098       1 leaderelection.go:121] The leader election gives 4 retries and allows for 30s of clock skew. The kube-apiserver downtime tolerance is 78s. Worst non-graceful lease acquisition is 2m43s. Worst graceful lease acquisition is {26s}.
I0509 03:15:06.983451       1 observer_polling.go:159] Starting file observer
I0509 03:15:06.983565       1 envvar.go:172] "Feature gate default state" feature="WatchListClient" enabled=false
I0509 03:15:06.983589       1 envvar.go:172] "Feature gate default state" feature="ClientsAllowCBOR" enabled=false
I0509 03:15:06.983595       1 envvar.go:172] "Feature gate default state" feature="ClientsPreferCBOR" enabled=false
I0509 03:15:06.983600       1 envvar.go:172] "Feature gate default state" feature="InformerResourceVersion" enabled=false
I0509 03:15:07.006006       1 builder.go:304] service-ca-operator version -
I0509 03:15:07.006621       1 dynamic_serving_content.go:116] "Loaded a new cert/key pair" name="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key"
I0509 03:15:07.835784       1 requestheader_controller.go:255] Loaded a new request header values for RequestHeaderAuthRequestController
I0509 03:15:07.841499       1 maxinflight.go:139] "Initialized nonMutatingChan" len=400
I0509 03:15:07.841514       1 maxinflight.go:145] "Initialized mutatingChan" len=200
I0509 03:15:07.841534       1 maxinflight.go:116] "Set denominator for readonly requests" limit=400
I0509 03:15:07.841540       1 maxinflight.go:120] "Set denominator for mutating requests" limit=200
I0509 03:15:07.844677       1 secure_serving.go:57] Forcing use of http/1.1 only
I0509 03:15:07.844690       1 genericapiserver.go:535] MuxAndDiscoveryComplete has all endpoints registered and discovery information is complete
W0509 03:15:07.844695       1 secure_serving.go:69] Use of insecure cipher 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256' detected.
W0509 03:15:07.844699       1 secure_serving.go:69] Use of insecure cipher 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256' detected.
W0509 03:15:07.844703       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_128_GCM_SHA256' detected.
W0509 03:15:07.844706       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_256_GCM_SHA384' detected.
W0509 03:15:07.844708       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_128_CBC_SHA' detected.
W0509 03:15:07.844711       1 secure_serving.go:69] Use of insecure cipher 'TLS_RSA_WITH_AES_256_CBC_SHA' detected.
I0509 03:15:07.849342       1 requestheader_controller.go:180] Starting RequestHeaderAuthRequestController
I0509 03:15:07.849359       1 configmap_cafile_content.go:205] "Starting controller" name="client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file"
I0509 03:15:07.849372       1 shared_informer.go:313] Waiting for caches to sync for RequestHeaderAuthRequestController
I0509 03:15:07.849374       1 shared_informer.go:313] Waiting for caches to sync for client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file
I0509 03:15:07.849358       1 configmap_cafile_content.go:205] "Starting controller" name="client-ca::kube-system::extension-apiserver-authentication::client-ca-file"
I0509 03:15:07.849398       1 shared_informer.go:313] Waiting for caches to sync for client-ca::kube-system::extension-apiserver-authentication::client-ca-file
I0509 03:15:07.849581       1 dynamic_serving_content.go:135] "Starting controller" name="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key"
I0509 03:15:07.849670       1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"metrics.openshift-service-ca-operator.svc\" [serving] validServingFor=[metrics.openshift-service-ca-operator.svc,metrics.openshift-service-ca-operator.svc.cluster.local] issuer=\"openshift-service-serving-signer@1778296442\" (2026-05-09 03:14:16 +0000 UTC to 2028-05-08 03:14:17 +0000 UTC (now=2026-05-09 03:15:07.849628521 +0000 UTC))"
I0509 03:15:07.850417       1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1778296507\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1778296507\" (2026-05-09 02:15:07 +0000 UTC to 2027-05-09 02:15:07 +0000 UTC (now=2026-05-09 03:15:07.850389932 +0000 UTC))"
I0509 03:15:07.850443       1 secure_serving.go:213] Serving securely on [::]:8443
I0509 03:15:07.850460       1 genericapiserver.go:685] [graceful-termination] waiting for shutdown to be initiated
I0509 03:15:07.850472       1 tlsconfig.go:243] "Starting DynamicServingCertificateController"
I0509 03:15:07.852370       1 leaderelection.go:257] attempting to acquire leader lease openshift-service-ca-operator/service-ca-operator-lock...
I0509 03:15:07.853210       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.853347       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.853417       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.870468       1 leaderelection.go:271] successfully acquired lease openshift-service-ca-operator/service-ca-operator-lock
I0509 03:15:07.870530       1 event.go:377] Event(v1.ObjectReference{Kind:"Lease", Namespace:"openshift-service-ca-operator", Name:"service-ca-operator-lock", UID:"b60867d5-ae99-4b08-89bf-8759e9d724ca", APIVersion:"coordination.k8s.io/v1", ResourceVersion:"11802", FieldPath:""}): type: 'Normal' reason: 'LeaderElection' service-ca-operator-686cb587d-qxtms_f30734b0-6bcb-4fc1-ad4b-f88a4194edfd became leader
I0509 03:15:07.871416       1 starter.go:111] Fetching FeatureGates
I0509 03:15:07.871546       1 simple_featuregate_reader.go:171] Starting feature-gate-detector
I0509 03:15:07.875578       1 reflector.go:376] Caches populated for *v1.FeatureGate from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.875590       1 reflector.go:376] Caches populated for *v1.ClusterVersion from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.875807       1 starter.go:160] Setting signing certificate lifetime to 18960h0m0s, minimum trust duration to 9480h0m0s
I0509 03:15:07.875815       1 event.go:377] Event(v1.ObjectReference{Kind:"Deployment", Namespace:"openshift-service-ca-operator", Name:"service-ca-operator", UID:"8de508c1-74ad-4d53-b06d-59cbd632e3fd", APIVersion:"apps/v1", ResourceVersion:"", FieldPath:""}): type: 'Normal' reason: 'FeatureGatesInitialized' FeatureGates updated to featuregates.Features{Enabled:[]v1.FeatureGateName{"AdditionalRoutingCapabilities", "AdminNetworkPolicy", "AlibabaPlatform", "AzureWorkloadIdentity", "BuildCSIVolumes", "CPMSMachineNamePrefix", "ConsolePluginContentSecurityPolicy", "ExternalOIDC", "ExternalOIDCWithUIDAndExtraClaimMappings", "GatewayAPI", "GatewayAPIController", "HighlyAvailableArbiter", "ImageVolume", "IngressControllerLBSubnetsAWS", "KMSv1", "MachineConfigNodes", "ManagedBootImages", "ManagedBootImagesAWS", "MetricsCollectionProfiles", "NetworkDiagnosticsConfig", "NetworkLiveMigration", "NetworkSegmentation", "PinnedImages", "PreconfiguredUDNAddresses", "ProcMountType", "RouteAdvertisements", "RouteExternalCertificate", "ServiceAccountTokenNodeBinding", "SetEIPForNLBIngressController", "SigstoreImageVerification", "StoragePerformantSecurityPolicy", "UpgradeStatus", "UserNamespacesPodSecurityStandards", "UserNamespacesSupport", "VSphereMultiDisk", "VSphereMultiNetworks"}, Disabled:[]v1.FeatureGateName{"AWSClusterHostedDNS", "AWSClusterHostedDNSInstall", "AWSDedicatedHosts", "AWSServiceLBNetworkSecurityGroup", "AutomatedEtcdBackup", "AzureClusterHostedDNSInstall", "AzureDedicatedHosts", "AzureMultiDisk", "BootImageSkewEnforcement", "BootcNodeManagement", "ClusterAPIInstall", "ClusterAPIInstallIBMCloud", "ClusterMonitoringConfig", "ClusterVersionOperatorConfiguration", "DNSNameResolver", "DualReplica", "DyanmicServiceEndpointIBMCloud", "DynamicResourceAllocation", "EtcdBackendQuota", "EventedPLEG", "Example", "Example2", "ExternalSnapshotMetadata", "GCPClusterHostedDNS", "GCPClusterHostedDNSInstall", "GCPCustomAPIEndpoints", "GCPCustomAPIEndpointsInstall", "ImageModeStatusReporting", "ImageStreamImportMode", "IngressControllerDynamicConfigurationManager", "InsightsConfig", "InsightsConfigAPI", "InsightsOnDemandDataGather", "IrreconcilableMachineConfig", "KMSEncryptionProvider", "MachineAPIMigration", "MachineAPIOperatorDisableMachineHealthCheckController", "ManagedBootImagesAzure", "ManagedBootImagesvSphere", "MaxUnavailableStatefulSet", "MinimumKubeletVersion", "MixedCPUsAllocation", "MultiArchInstallAzure", "MultiDiskSetup", "MutatingAdmissionPolicy", "NewOLM", "NewOLMCatalogdAPIV1Metas", "NewOLMOwnSingleNamespace", "NewOLMPreflightPermissionChecks", "NewOLMWebhookProviderOpenshiftServiceCA", "NoRegistryClusterOperations", "NodeSwap", "NutanixMultiSubnets", "OVNObservability", "OpenShiftPodSecurityAdmission", "SELinuxMount", "ShortCertRotation", "SignatureStores", "SigstoreImageVerificationPKI", "TranslateStreamCloseWebsocketRequests", "VSphereConfigurableMaxAllowedBlockVolumesPerNode", "VSphereHostVMGroupZonal", "VSphereMixedNodeEnv", "VolumeAttributesClass", "VolumeGroupSnapshot"}}
I0509 03:15:07.876087       1 base_controller.go:76] Waiting for caches to sync for resource-sync
I0509 03:15:07.876275       1 base_controller.go:76] Waiting for caches to sync for ServiceCAOperator
I0509 03:15:07.876308       1 base_controller.go:76] Waiting for caches to sync for LoggingSyncer
I0509 03:15:07.876756       1 base_controller.go:76] Waiting for caches to sync for StatusSyncer_service-ca
I0509 03:15:07.880257       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.881839       1 reflector.go:376] Caches populated for *v1.ClusterOperator from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.883990       1 reflector.go:376] Caches populated for *v1.ServiceAccount from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.883998       1 reflector.go:376] Caches populated for *v1.Deployment from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.884275       1 reflector.go:376] Caches populated for *v1.ServiceCA from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.884504       1 reflector.go:376] Caches populated for *v1.Infrastructure from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.884906       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.885088       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.885193       1 reflector.go:376] Caches populated for *v1.Secret from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.885249       1 reflector.go:376] Caches populated for *v1.Secret from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.885284       1 reflector.go:376] Caches populated for *v1.Secret from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.885425       1 reflector.go:376] Caches populated for *v1.Secret from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.885954       1 reflector.go:376] Caches populated for *v1.Namespace from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.901962       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:07.949625       1 shared_informer.go:320] Caches are synced for RequestHeaderAuthRequestController
I0509 03:15:07.949702       1 shared_informer.go:320] Caches are synced for client-ca::kube-system::extension-apiserver-authentication::client-ca-file
I0509 03:15:07.949713       1 shared_informer.go:320] Caches are synced for client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file
I0509 03:15:07.949856       1 tlsconfig.go:181] "Loaded client CA" index=0 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"aggregator-signer\" [] issuer=\"<self>\" (2026-05-09 02:58:49 +0000 UTC to 2036-05-06 02:58:49 +0000 UTC (now=2026-05-09 03:15:07.949834041 +0000 UTC))"
I0509 03:15:07.950059       1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"metrics.openshift-service-ca-operator.svc\" [serving] validServingFor=[metrics.openshift-service-ca-operator.svc,metrics.openshift-service-ca-operator.svc.cluster.local] issuer=\"openshift-service-serving-signer@1778296442\" (2026-05-09 03:14:16 +0000 UTC to 2028-05-08 03:14:17 +0000 UTC (now=2026-05-09 03:15:07.950044482 +0000 UTC))"
I0509 03:15:07.950254       1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1778296507\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1778296507\" (2026-05-09 02:15:07 +0000 UTC to 2027-05-09 02:15:07 +0000 UTC (now=2026-05-09 03:15:07.950241995 +0000 UTC))"
I0509 03:15:07.950393       1 tlsconfig.go:181] "Loaded client CA" index=0 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-control-plane-signer\" [] issuer=\"<self>\" (2026-05-09 02:58:52 +0000 UTC to 2036-05-06 02:58:52 +0000 UTC (now=2026-05-09 03:15:07.950381747 +0000 UTC))"
I0509 03:15:07.950413       1 tlsconfig.go:181] "Loaded client CA" index=1 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-apiserver-to-kubelet-signer\" [] issuer=\"<self>\" (2026-05-09 02:58:53 +0000 UTC to 2036-05-06 02:58:53 +0000 UTC (now=2026-05-09 03:15:07.950404252 +0000 UTC))"
I0509 03:15:07.950433       1 tlsconfig.go:181] "Loaded client CA" index=2 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"admin-kubeconfig-signer\" [] issuer=\"<self>\" (2026-05-09 02:58:56 +0000 UTC to 2036-05-06 02:58:56 +0000 UTC (now=2026-05-09 03:15:07.95042165 +0000 UTC))"
I0509 03:15:07.950457       1 tlsconfig.go:181] "Loaded client CA" index=3 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"hcco-signer\" [] issuer=\"<self>\" (2026-05-09 02:58:58 +0000 UTC to 2036-05-06 02:58:58 +0000 UTC (now=2026-05-09 03:15:07.950442726 +0000 UTC))"
I0509 03:15:07.950474       1 tlsconfig.go:181] "Loaded client CA" index=4 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"kube-csr-signer\" [] issuer=\"<self>\" (2026-05-09 02:59:00 +0000 UTC to 2036-05-06 02:59:00 +0000 UTC (now=2026-05-09 03:15:07.95046614 +0000 UTC))"
I0509 03:15:07.950491       1 tlsconfig.go:181] "Loaded client CA" index=5 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"ocm-production-2q657b3n075gadd3dulh07oh0strk590-kx-af110589fb_customer-system-admin-signer@1778295651\" [] issuer=\"<self>\" (2026-05-09 03:00:51 +0000 UTC to 2026-05-16 03:00:52 +0000 UTC (now=2026-05-09 03:15:07.950482521 +0000 UTC))"
I0509 03:15:07.950507       1 tlsconfig.go:181] "Loaded client CA" index=6 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"ocm-production-2q657b3n075gadd3dulh07oh0strk590-kx-af110589fb_sre-system-admin-signer@1778295651\" [] issuer=\"<self>\" (2026-05-09 03:00:51 +0000 UTC to 2026-05-16 03:00:52 +0000 UTC (now=2026-05-09 03:15:07.950498982 +0000 UTC))"
I0509 03:15:07.950522       1 tlsconfig.go:181] "Loaded client CA" index=7 certName="client-ca::kube-system::extension-apiserver-authentication::client-ca-file,client-ca::kube-system::extension-apiserver-authentication::requestheader-client-ca-file" certDetail="\"aggregator-signer\" [] issuer=\"<self>\" (2026-05-09 02:58:49 +0000 UTC to 2036-05-06 02:58:49 +0000 UTC (now=2026-05-09 03:15:07.950514621 +0000 UTC))"
I0509 03:15:07.950684       1 tlsconfig.go:203] "Loaded serving cert" certName="serving-cert::/var/run/secrets/serving-cert/tls.crt::/var/run/secrets/serving-cert/tls.key" certDetail="\"metrics.openshift-service-ca-operator.svc\" [serving] validServingFor=[metrics.openshift-service-ca-operator.svc,metrics.openshift-service-ca-operator.svc.cluster.local] issuer=\"openshift-service-serving-signer@1778296442\" (2026-05-09 03:14:16 +0000 UTC to 2028-05-08 03:14:17 +0000 UTC (now=2026-05-09 03:15:07.950673082 +0000 UTC))"
I0509 03:15:07.950833       1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1778296507\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1778296507\" (2026-05-09 02:15:07 +0000 UTC to 2027-05-09 02:15:07 +0000 UTC (now=2026-05-09 03:15:07.950823612 +0000 UTC))"
I0509 03:15:07.976888       1 base_controller.go:82] Caches are synced for LoggingSyncer 
I0509 03:15:07.976907       1 base_controller.go:119] Starting #1 worker of LoggingSyncer controller ...
I0509 03:15:07.976978       1 base_controller.go:82] Caches are synced for StatusSyncer_service-ca 
I0509 03:15:07.976991       1 base_controller.go:119] Starting #1 worker of StatusSyncer_service-ca controller ...
I0509 03:15:08.079376       1 reflector.go:376] Caches populated for *v1.ConfigMap from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:08.177229       1 base_controller.go:82] Caches are synced for ServiceCAOperator 
I0509 03:15:08.177274       1 base_controller.go:119] Starting #1 worker of ServiceCAOperator controller ...
I0509 03:15:08.279840       1 reflector.go:376] Caches populated for *v1.Secret from k8s.io/client-go@v0.32.2/tools/cache/reflector.go:251
I0509 03:15:08.376740       1 base_controller.go:82] Caches are synced for resource-sync 
I0509 03:15:08.376758       1 base_controller.go:119] Starting #1 worker of resource-sync controller ...