--- apiVersion: apps/v1 items: - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "1" deployment.kubernetes.io/revision: "2" operator.openshift.io/rvs-hash: IApByac2xfijWytPfHtP0KKuXHffIPS6cDZAn5WX5OBVDPFfJ1b2fIcI96sSiXCNOyJVr7aFaE6NVgTx1-Qxnw operator.openshift.io/spec-hash: 74b87176fd60027de112de1c39ffca35e9d1c15bbbc45f3c0f903e15139c2786 creationTimestamp: "2026-02-24T05:38:11Z" generation: 3 labels: app: oauth-openshift oauth-openshift-anti-affinity: "true" pod-template-hash: 5584b45765 managedFields: - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:deployment.kubernetes.io/desired-replicas: {} f:deployment.kubernetes.io/max-replicas: {} f:deployment.kubernetes.io/revision: {} f:operator.openshift.io/rvs-hash: {} f:operator.openshift.io/spec-hash: {} f:labels: .: {} f:app: {} f:oauth-openshift-anti-affinity: {} f:pod-template-hash: {} f:ownerReferences: .: {} k:{"uid":"8b12a497-dc22-4051-a79b-0cc98f672c7a"}: {} f:spec: f:replicas: {} f:selector: {} f:template: f:metadata: f:annotations: .: {} f:openshift.io/required-scc: {} f:operator.openshift.io/bootstrap-user-exists: {} f:operator.openshift.io/rvs-hash: {} f:target.workload.openshift.io/management: {} f:labels: .: {} f:app: {} f:oauth-openshift-anti-affinity: {} f:pod-template-hash: {} f:name: {} f:namespace: {} f:spec: f:affinity: .: {} f:podAntiAffinity: .: {} f:requiredDuringSchedulingIgnoredDuringExecution: {} f:containers: k:{"name":"oauth-openshift"}: .: {} f:args: {} f:command: {} f:image: {} f:imagePullPolicy: {} f:lifecycle: .: {} f:preStop: .: {} f:exec: .: {} f:command: {} f:livenessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:name: {} f:ports: .: {} k:{"containerPort":6443,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} f:readinessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:resources: .: {} f:requests: .: {} f:cpu: {} f:memory: {} f:securityContext: .: {} f:privileged: {} f:readOnlyRootFilesystem: {} f:runAsUser: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-cliconfig"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-service-ca"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-ocp-branding-template"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-router-certs"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-serving-cert"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-session"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-error"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-login"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-provider-selection"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/log/oauth-server"}: .: {} f:mountPath: {} f:name: {} k:{"mountPath":"/var/run/configmaps/audit"}: .: {} f:mountPath: {} f:name: {} f:dnsPolicy: {} f:nodeSelector: {} f:priorityClassName: {} f:restartPolicy: {} f:schedulerName: {} f:securityContext: {} f:serviceAccount: {} f:serviceAccountName: {} f:terminationGracePeriodSeconds: {} f:tolerations: {} f:volumes: .: {} k:{"name":"audit-dir"}: .: {} f:hostPath: .: {} f:path: {} f:type: {} f:name: {} k:{"name":"audit-policies"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-cliconfig"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-ocp-branding-template"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-router-certs"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-service-ca"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-serving-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-session"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-trusted-ca-bundle"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:optional: {} f:name: {} k:{"name":"v4-0-config-user-template-error"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"v4-0-config-user-template-login"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"v4-0-config-user-template-provider-selection"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} manager: kube-controller-manager operation: Update time: "2026-02-24T05:38:27Z" - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:status: f:observedGeneration: {} f:replicas: {} manager: kube-controller-manager operation: Update subresource: status time: "2026-02-24T05:38:27Z" name: oauth-openshift-5584b45765 namespace: openshift-authentication ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: oauth-openshift uid: 8b12a497-dc22-4051-a79b-0cc98f672c7a resourceVersion: "16335" uid: 34203074-5ea7-4aa2-8a42-5494e80e49e2 spec: replicas: 0 selector: matchLabels: app: oauth-openshift pod-template-hash: 5584b45765 template: metadata: annotations: openshift.io/required-scc: privileged operator.openshift.io/bootstrap-user-exists: "true" operator.openshift.io/rvs-hash: IApByac2xfijWytPfHtP0KKuXHffIPS6cDZAn5WX5OBVDPFfJ1b2fIcI96sSiXCNOyJVr7aFaE6NVgTx1-Qxnw target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' creationTimestamp: null labels: app: oauth-openshift oauth-openshift-anti-affinity: "true" pod-template-hash: 5584b45765 name: oauth-openshift namespace: openshift-authentication spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: app: oauth-openshift oauth-openshift-anti-affinity: "true" topologyKey: kubernetes.io/hostname containers: - args: - | if [ -s /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt ]; then echo "Copying system trust bundle" cp -f /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem fi exec oauth-server osinserver \ --config=/var/config/system/configmaps/v4-0-config-system-cliconfig/v4-0-config-system-cliconfig \ --v=2 \ --audit-log-format=json \ --audit-log-maxbackup=10 \ --audit-log-maxsize=100 \ --audit-log-path=/var/log/oauth-server/audit.log \ --audit-policy-file=/var/run/configmaps/audit/audit.yaml command: - /bin/bash - -ec image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3167ddf67ad2f83e1a3f49ac6c7ee826469ce9ec16db6390f6a94dac24f6a346 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - sleep - "25" livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: oauth-openshift ports: - containerPort: 6443 name: https protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6443 scheme: HTTPS periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 10m memory: 50Mi securityContext: privileged: true readOnlyRootFilesystem: false runAsUser: 0 terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/configmaps/audit name: audit-policies - mountPath: /var/log/oauth-server name: audit-dir - mountPath: /var/config/system/secrets/v4-0-config-system-session name: v4-0-config-system-session readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-cliconfig name: v4-0-config-system-cliconfig readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-serving-cert name: v4-0-config-system-serving-cert readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-service-ca name: v4-0-config-system-service-ca readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-router-certs name: v4-0-config-system-router-certs readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-ocp-branding-template name: v4-0-config-system-ocp-branding-template readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-login name: v4-0-config-user-template-login readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-provider-selection name: v4-0-config-user-template-provider-selection readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-error name: v4-0-config-user-template-error readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle name: v4-0-config-system-trusted-ca-bundle readOnly: true dnsPolicy: ClusterFirst nodeSelector: node-role.kubernetes.io/master: "" priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: oauth-openshift serviceAccountName: oauth-openshift terminationGracePeriodSeconds: 40 tolerations: - effect: NoSchedule key: node-role.kubernetes.io/master operator: Exists - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 120 - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 120 volumes: - configMap: defaultMode: 420 name: audit name: audit-policies - hostPath: path: /var/log/oauth-server type: "" name: audit-dir - name: v4-0-config-system-session secret: defaultMode: 420 secretName: v4-0-config-system-session - configMap: defaultMode: 420 name: v4-0-config-system-cliconfig name: v4-0-config-system-cliconfig - name: v4-0-config-system-serving-cert secret: defaultMode: 420 secretName: v4-0-config-system-serving-cert - configMap: defaultMode: 420 name: v4-0-config-system-service-ca name: v4-0-config-system-service-ca - name: v4-0-config-system-router-certs secret: defaultMode: 420 secretName: v4-0-config-system-router-certs - name: v4-0-config-system-ocp-branding-template secret: defaultMode: 420 secretName: v4-0-config-system-ocp-branding-template - name: v4-0-config-user-template-login secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-login - name: v4-0-config-user-template-provider-selection secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-provider-selection - name: v4-0-config-user-template-error secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-error - configMap: defaultMode: 420 name: v4-0-config-system-trusted-ca-bundle optional: true name: v4-0-config-system-trusted-ca-bundle status: observedGeneration: 3 replicas: 0 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "1" deployment.kubernetes.io/revision: "3" operator.openshift.io/rvs-hash: cUHXBUWrJ_NnpiTrqIzwZI6R-VvnSTSDoNkdTYus-jiE1nqTKxI9mC6wZ1e9JdRMu6VpzFbc4KOnOKWV_qaf5g operator.openshift.io/spec-hash: 06295c51ecc9afe19510337404099e5974e330d23b5a1225516605c466af8be7 creationTimestamp: "2026-02-24T05:38:27Z" generation: 2 labels: app: oauth-openshift oauth-openshift-anti-affinity: "true" pod-template-hash: 64b7796859 managedFields: - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:deployment.kubernetes.io/desired-replicas: {} f:deployment.kubernetes.io/max-replicas: {} f:deployment.kubernetes.io/revision: {} f:operator.openshift.io/rvs-hash: {} f:operator.openshift.io/spec-hash: {} f:labels: .: {} f:app: {} f:oauth-openshift-anti-affinity: {} f:pod-template-hash: {} f:ownerReferences: .: {} k:{"uid":"8b12a497-dc22-4051-a79b-0cc98f672c7a"}: {} f:spec: f:replicas: {} f:selector: {} f:template: f:metadata: f:annotations: .: {} f:openshift.io/required-scc: {} f:operator.openshift.io/bootstrap-user-exists: {} f:operator.openshift.io/rvs-hash: {} f:target.workload.openshift.io/management: {} f:labels: .: {} f:app: {} f:oauth-openshift-anti-affinity: {} f:pod-template-hash: {} f:name: {} f:namespace: {} f:spec: f:affinity: .: {} f:podAntiAffinity: .: {} f:requiredDuringSchedulingIgnoredDuringExecution: {} f:containers: k:{"name":"oauth-openshift"}: .: {} f:args: {} f:command: {} f:image: {} f:imagePullPolicy: {} f:lifecycle: .: {} f:preStop: .: {} f:exec: .: {} f:command: {} f:livenessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:name: {} f:ports: .: {} k:{"containerPort":6443,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} f:readinessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:resources: .: {} f:requests: .: {} f:cpu: {} f:memory: {} f:securityContext: .: {} f:privileged: {} f:readOnlyRootFilesystem: {} f:runAsUser: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-cliconfig"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-service-ca"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-ocp-branding-template"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-router-certs"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-serving-cert"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-session"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-error"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-login"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-provider-selection"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/log/oauth-server"}: .: {} f:mountPath: {} f:name: {} k:{"mountPath":"/var/run/configmaps/audit"}: .: {} f:mountPath: {} f:name: {} f:dnsPolicy: {} f:nodeSelector: {} f:priorityClassName: {} f:restartPolicy: {} f:schedulerName: {} f:securityContext: {} f:serviceAccount: {} f:serviceAccountName: {} f:terminationGracePeriodSeconds: {} f:tolerations: {} f:volumes: .: {} k:{"name":"audit-dir"}: .: {} f:hostPath: .: {} f:path: {} f:type: {} f:name: {} k:{"name":"audit-policies"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-cliconfig"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-ocp-branding-template"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-router-certs"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-service-ca"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-serving-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-session"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-trusted-ca-bundle"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:optional: {} f:name: {} k:{"name":"v4-0-config-user-template-error"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"v4-0-config-user-template-login"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"v4-0-config-user-template-provider-selection"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} manager: kube-controller-manager operation: Update time: "2026-02-24T05:38:27Z" - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:status: f:availableReplicas: {} f:fullyLabeledReplicas: {} f:observedGeneration: {} f:readyReplicas: {} f:replicas: {} manager: kube-controller-manager operation: Update subresource: status time: "2026-02-24T05:38:39Z" name: oauth-openshift-64b7796859 namespace: openshift-authentication ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: oauth-openshift uid: 8b12a497-dc22-4051-a79b-0cc98f672c7a resourceVersion: "16437" uid: e2a72f6c-f2cc-415d-a6fb-ae9aaca3b1f1 spec: replicas: 1 selector: matchLabels: app: oauth-openshift pod-template-hash: 64b7796859 template: metadata: annotations: openshift.io/required-scc: privileged operator.openshift.io/bootstrap-user-exists: "true" operator.openshift.io/rvs-hash: cUHXBUWrJ_NnpiTrqIzwZI6R-VvnSTSDoNkdTYus-jiE1nqTKxI9mC6wZ1e9JdRMu6VpzFbc4KOnOKWV_qaf5g target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' creationTimestamp: null labels: app: oauth-openshift oauth-openshift-anti-affinity: "true" pod-template-hash: 64b7796859 name: oauth-openshift namespace: openshift-authentication spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: app: oauth-openshift oauth-openshift-anti-affinity: "true" topologyKey: kubernetes.io/hostname containers: - args: - | if [ -s /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt ]; then echo "Copying system trust bundle" cp -f /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem fi exec oauth-server osinserver \ --config=/var/config/system/configmaps/v4-0-config-system-cliconfig/v4-0-config-system-cliconfig \ --v=2 \ --audit-log-format=json \ --audit-log-maxbackup=10 \ --audit-log-maxsize=100 \ --audit-log-path=/var/log/oauth-server/audit.log \ --audit-policy-file=/var/run/configmaps/audit/audit.yaml command: - /bin/bash - -ec image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3167ddf67ad2f83e1a3f49ac6c7ee826469ce9ec16db6390f6a94dac24f6a346 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - sleep - "25" livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: oauth-openshift ports: - containerPort: 6443 name: https protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6443 scheme: HTTPS periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 10m memory: 50Mi securityContext: privileged: true readOnlyRootFilesystem: false runAsUser: 0 terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/configmaps/audit name: audit-policies - mountPath: /var/log/oauth-server name: audit-dir - mountPath: /var/config/system/secrets/v4-0-config-system-session name: v4-0-config-system-session readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-cliconfig name: v4-0-config-system-cliconfig readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-serving-cert name: v4-0-config-system-serving-cert readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-service-ca name: v4-0-config-system-service-ca readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-router-certs name: v4-0-config-system-router-certs readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-ocp-branding-template name: v4-0-config-system-ocp-branding-template readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-login name: v4-0-config-user-template-login readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-provider-selection name: v4-0-config-user-template-provider-selection readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-error name: v4-0-config-user-template-error readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle name: v4-0-config-system-trusted-ca-bundle readOnly: true dnsPolicy: ClusterFirst nodeSelector: node-role.kubernetes.io/master: "" priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: oauth-openshift serviceAccountName: oauth-openshift terminationGracePeriodSeconds: 40 tolerations: - effect: NoSchedule key: node-role.kubernetes.io/master operator: Exists - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 120 - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 120 volumes: - configMap: defaultMode: 420 name: audit name: audit-policies - hostPath: path: /var/log/oauth-server type: "" name: audit-dir - name: v4-0-config-system-session secret: defaultMode: 420 secretName: v4-0-config-system-session - configMap: defaultMode: 420 name: v4-0-config-system-cliconfig name: v4-0-config-system-cliconfig - name: v4-0-config-system-serving-cert secret: defaultMode: 420 secretName: v4-0-config-system-serving-cert - configMap: defaultMode: 420 name: v4-0-config-system-service-ca name: v4-0-config-system-service-ca - name: v4-0-config-system-router-certs secret: defaultMode: 420 secretName: v4-0-config-system-router-certs - name: v4-0-config-system-ocp-branding-template secret: defaultMode: 420 secretName: v4-0-config-system-ocp-branding-template - name: v4-0-config-user-template-login secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-login - name: v4-0-config-user-template-provider-selection secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-provider-selection - name: v4-0-config-user-template-error secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-error - configMap: defaultMode: 420 name: v4-0-config-system-trusted-ca-bundle optional: true name: v4-0-config-system-trusted-ca-bundle status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 2 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "1" deployment.kubernetes.io/revision: "1" operator.openshift.io/rvs-hash: COSJgKmFVqV03n6QhD-r1r1fub7x3DjZ0grrC4iYDEbzFF8bI_FSBt4G6XoNh2aVnuPT1gysVC4LTXFCpdZDlA operator.openshift.io/spec-hash: fd014a78529d880ba0765633608b5ea2afadf52a935db85262a06b812493f1b0 creationTimestamp: "2026-02-24T05:37:45Z" generation: 2 labels: app: oauth-openshift oauth-openshift-anti-affinity: "true" pod-template-hash: 6d4d899fc6 managedFields: - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:deployment.kubernetes.io/desired-replicas: {} f:deployment.kubernetes.io/max-replicas: {} f:deployment.kubernetes.io/revision: {} f:operator.openshift.io/rvs-hash: {} f:operator.openshift.io/spec-hash: {} f:labels: .: {} f:app: {} f:oauth-openshift-anti-affinity: {} f:pod-template-hash: {} f:ownerReferences: .: {} k:{"uid":"8b12a497-dc22-4051-a79b-0cc98f672c7a"}: {} f:spec: f:replicas: {} f:selector: {} f:template: f:metadata: f:annotations: .: {} f:openshift.io/required-scc: {} f:operator.openshift.io/bootstrap-user-exists: {} f:operator.openshift.io/rvs-hash: {} f:target.workload.openshift.io/management: {} f:labels: .: {} f:app: {} f:oauth-openshift-anti-affinity: {} f:pod-template-hash: {} f:name: {} f:namespace: {} f:spec: f:affinity: .: {} f:podAntiAffinity: .: {} f:requiredDuringSchedulingIgnoredDuringExecution: {} f:containers: k:{"name":"oauth-openshift"}: .: {} f:args: {} f:command: {} f:image: {} f:imagePullPolicy: {} f:lifecycle: .: {} f:preStop: .: {} f:exec: .: {} f:command: {} f:livenessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:name: {} f:ports: .: {} k:{"containerPort":6443,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} f:readinessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:resources: .: {} f:requests: .: {} f:cpu: {} f:memory: {} f:securityContext: .: {} f:privileged: {} f:readOnlyRootFilesystem: {} f:runAsUser: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-cliconfig"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-service-ca"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-ocp-branding-template"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-router-certs"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-serving-cert"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/system/secrets/v4-0-config-system-session"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-error"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-login"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/config/user/template/secret/v4-0-config-user-template-provider-selection"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/var/log/oauth-server"}: .: {} f:mountPath: {} f:name: {} k:{"mountPath":"/var/run/configmaps/audit"}: .: {} f:mountPath: {} f:name: {} f:dnsPolicy: {} f:nodeSelector: {} f:priorityClassName: {} f:restartPolicy: {} f:schedulerName: {} f:securityContext: {} f:serviceAccount: {} f:serviceAccountName: {} f:terminationGracePeriodSeconds: {} f:tolerations: {} f:volumes: .: {} k:{"name":"audit-dir"}: .: {} f:hostPath: .: {} f:path: {} f:type: {} f:name: {} k:{"name":"audit-policies"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-cliconfig"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-ocp-branding-template"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-router-certs"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-service-ca"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"v4-0-config-system-serving-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-session"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} k:{"name":"v4-0-config-system-trusted-ca-bundle"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:optional: {} f:name: {} k:{"name":"v4-0-config-user-template-error"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"v4-0-config-user-template-login"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"v4-0-config-user-template-provider-selection"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} manager: kube-controller-manager operation: Update time: "2026-02-24T05:38:11Z" - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:status: f:observedGeneration: {} f:replicas: {} manager: kube-controller-manager operation: Update subresource: status time: "2026-02-24T05:38:11Z" name: oauth-openshift-6d4d899fc6 namespace: openshift-authentication ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: oauth-openshift uid: 8b12a497-dc22-4051-a79b-0cc98f672c7a resourceVersion: "15915" uid: 7a00bb48-0c73-4a1b-b15b-4d577a6c9b80 spec: replicas: 0 selector: matchLabels: app: oauth-openshift pod-template-hash: 6d4d899fc6 template: metadata: annotations: openshift.io/required-scc: privileged operator.openshift.io/bootstrap-user-exists: "true" operator.openshift.io/rvs-hash: COSJgKmFVqV03n6QhD-r1r1fub7x3DjZ0grrC4iYDEbzFF8bI_FSBt4G6XoNh2aVnuPT1gysVC4LTXFCpdZDlA target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' creationTimestamp: null labels: app: oauth-openshift oauth-openshift-anti-affinity: "true" pod-template-hash: 6d4d899fc6 name: oauth-openshift namespace: openshift-authentication spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: app: oauth-openshift oauth-openshift-anti-affinity: "true" topologyKey: kubernetes.io/hostname containers: - args: - | if [ -s /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt ]; then echo "Copying system trust bundle" cp -f /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle/ca-bundle.crt /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem fi exec oauth-server osinserver \ --config=/var/config/system/configmaps/v4-0-config-system-cliconfig/v4-0-config-system-cliconfig \ --v=2 \ --audit-log-format=json \ --audit-log-maxbackup=10 \ --audit-log-maxsize=100 \ --audit-log-path=/var/log/oauth-server/audit.log \ --audit-policy-file=/var/run/configmaps/audit/audit.yaml command: - /bin/bash - -ec image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3167ddf67ad2f83e1a3f49ac6c7ee826469ce9ec16db6390f6a94dac24f6a346 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - sleep - "25" livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: oauth-openshift ports: - containerPort: 6443 name: https protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6443 scheme: HTTPS periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 10m memory: 50Mi securityContext: privileged: true readOnlyRootFilesystem: false runAsUser: 0 terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /var/run/configmaps/audit name: audit-policies - mountPath: /var/log/oauth-server name: audit-dir - mountPath: /var/config/system/secrets/v4-0-config-system-session name: v4-0-config-system-session readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-cliconfig name: v4-0-config-system-cliconfig readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-serving-cert name: v4-0-config-system-serving-cert readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-service-ca name: v4-0-config-system-service-ca readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-router-certs name: v4-0-config-system-router-certs readOnly: true - mountPath: /var/config/system/secrets/v4-0-config-system-ocp-branding-template name: v4-0-config-system-ocp-branding-template readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-login name: v4-0-config-user-template-login readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-provider-selection name: v4-0-config-user-template-provider-selection readOnly: true - mountPath: /var/config/user/template/secret/v4-0-config-user-template-error name: v4-0-config-user-template-error readOnly: true - mountPath: /var/config/system/configmaps/v4-0-config-system-trusted-ca-bundle name: v4-0-config-system-trusted-ca-bundle readOnly: true dnsPolicy: ClusterFirst nodeSelector: node-role.kubernetes.io/master: "" priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: oauth-openshift serviceAccountName: oauth-openshift terminationGracePeriodSeconds: 40 tolerations: - effect: NoSchedule key: node-role.kubernetes.io/master operator: Exists - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 120 - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 120 volumes: - configMap: defaultMode: 420 name: audit name: audit-policies - hostPath: path: /var/log/oauth-server type: "" name: audit-dir - name: v4-0-config-system-session secret: defaultMode: 420 secretName: v4-0-config-system-session - configMap: defaultMode: 420 name: v4-0-config-system-cliconfig name: v4-0-config-system-cliconfig - name: v4-0-config-system-serving-cert secret: defaultMode: 420 secretName: v4-0-config-system-serving-cert - configMap: defaultMode: 420 name: v4-0-config-system-service-ca name: v4-0-config-system-service-ca - name: v4-0-config-system-router-certs secret: defaultMode: 420 secretName: v4-0-config-system-router-certs - name: v4-0-config-system-ocp-branding-template secret: defaultMode: 420 secretName: v4-0-config-system-ocp-branding-template - name: v4-0-config-user-template-login secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-login - name: v4-0-config-user-template-provider-selection secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-provider-selection - name: v4-0-config-user-template-error secret: defaultMode: 420 optional: true secretName: v4-0-config-user-template-error - configMap: defaultMode: 420 name: v4-0-config-system-trusted-ca-bundle optional: true name: v4-0-config-system-trusted-ca-bundle status: observedGeneration: 2 replicas: 0 kind: ReplicaSetList metadata: resourceVersion: "54246"