---
apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.130.0.44/23"],"mac_address":"0a:58:0a:82:00:2c","gateway_ips":["10.130.0.1"],"routes":[{"dest":"10.128.0.0/14","nextHop":"10.130.0.1"},{"dest":"172.30.0.0/16","nextHop":"10.130.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.130.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.130.0.1"}],"ip_address":"10.130.0.44/23","gateway_ip":"10.130.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.130.0.44"
            ],
            "mac": "0a:58:0a:82:00:2c",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /metrics
      prometheus.io/port: "9402"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
    creationTimestamp: "2025-10-14T13:29:23Z"
    generateName: cert-manager-7d4cc89fcb-
    labels:
      app: cert-manager
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: cert-manager
      app.kubernetes.io/version: v1.17.4
      pod-template-hash: 7d4cc89fcb
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"e2401d9b-ce3d-4abe-99fb-d44eaeb2604a"}: {}
        f:spec:
          f:containers:
            k:{"name":"cert-manager-controller"}:
              .: {}
              f:args: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9402,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9403,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/var/run/secrets/openshift/serviceaccount"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"bound-sa-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:29:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: master-0
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:23Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.130.0.44"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:24Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:24Z"
    name: cert-manager-7d4cc89fcb-mcxbx
    namespace: cert-manager
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: cert-manager-7d4cc89fcb
      uid: e2401d9b-ce3d-4abe-99fb-d44eaeb2604a
    resourceVersion: "29281"
    uid: 654a7d43-76e0-4929-85b5-50434664acb7
  spec:
    containers:
    - args:
      - --acme-http01-solver-image=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4f7c045819c39e176a6090efdaba6ec736edf772d88fc87dd1c6fb33d3b5b26b
      - --cluster-resource-namespace=$(POD_NAMESPACE)
      - --leader-election-namespace=kube-system
      - --max-concurrent-challenges=60
      - --v=2
      command:
      - /app/cmd/controller/controller
      env:
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 8
        httpGet:
          path: /livez
          port: http-healthz
          scheme: HTTP
        initialDelaySeconds: 10
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 15
      name: cert-manager-controller
      ports:
      - containerPort: 9402
        name: http-metrics
        protocol: TCP
      - containerPort: 9403
        name: http-healthz
        protocol: TCP
      resources: {}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000780000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6g9rr
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: false
    nodeName: master-0
    nodeSelector:
      kubernetes.io/os: linux
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000780000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c28,c12
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: cert-manager
    serviceAccountName: cert-manager
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    volumes:
    - name: bound-sa-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: openshift
            expirationSeconds: 3600
            path: token
    - name: kube-api-access-6g9rr
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:24Z"
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:23Z"
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:24Z"
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:24Z"
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:23Z"
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://712dccf5b06a81f06dfc83a8eeda99520e9dfa96286b63937b04e97f978e0ef3
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
      imageID: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:71996bffd7fe18b8273f2926f7b3bb60c900ce30e4cd13dcc2dcac50e7df99f0
      lastState: {}
      name: cert-manager-controller
      ready: true
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2025-10-14T13:29:24Z"
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-6g9rr
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 192.168.34.10
    hostIPs:
    - ip: 192.168.34.10
    phase: Running
    podIP: 10.130.0.44
    podIPs:
    - ip: 10.130.0.44
    qosClass: BestEffort
    startTime: "2025-10-14T13:29:23Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.130.0.36/23"],"mac_address":"0a:58:0a:82:00:24","gateway_ips":["10.130.0.1"],"routes":[{"dest":"10.128.0.0/14","nextHop":"10.130.0.1"},{"dest":"172.30.0.0/16","nextHop":"10.130.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.130.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.130.0.1"}],"ip_address":"10.130.0.36/23","gateway_ip":"10.130.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.130.0.36"
            ],
            "mac": "0a:58:0a:82:00:24",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /metrics
      prometheus.io/port: "9402"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
    creationTimestamp: "2025-10-14T13:29:08Z"
    generateName: cert-manager-cainjector-7d9f95dbf-
    labels:
      app: cainjector
      app.kubernetes.io/component: cainjector
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: cainjector
      app.kubernetes.io/version: v1.17.4
      pod-template-hash: 7d9f95dbf
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"ee826f6b-7602-49b2-ab8e-c6f7c5b74978"}: {}
        f:spec:
          f:containers:
            k:{"name":"cert-manager-cainjector"}:
              .: {}
              f:args: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":9402,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:resources: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/var/run/secrets/openshift/serviceaccount"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"bound-sa-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:29:08Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: master-0
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:08Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.130.0.36"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:10Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:10Z"
    name: cert-manager-cainjector-7d9f95dbf-pxbjj
    namespace: cert-manager
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: cert-manager-cainjector-7d9f95dbf
      uid: ee826f6b-7602-49b2-ab8e-c6f7c5b74978
    resourceVersion: "28323"
    uid: 7df2b6e4-2b0e-4005-ab5c-0ab05ade8fc5
  spec:
    containers:
    - args:
      - --leader-election-namespace=kube-system
      - --v=2
      command:
      - /app/cmd/cainjector/cainjector
      env:
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
      imagePullPolicy: IfNotPresent
      name: cert-manager-cainjector
      ports:
      - containerPort: 9402
        name: http-metrics
        protocol: TCP
      resources: {}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000780000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zmnz9
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: false
    nodeName: master-0
    nodeSelector:
      kubernetes.io/os: linux
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000780000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c28,c12
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: cert-manager-cainjector
    serviceAccountName: cert-manager-cainjector
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    volumes:
    - name: bound-sa-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: openshift
            expirationSeconds: 3600
            path: token
    - name: kube-api-access-zmnz9
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:10Z"
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:08Z"
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:10Z"
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:10Z"
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:08Z"
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://f50ffdf714b706bb8f122c8fe21b548727425b498f14d4a3e26d6bb5fbe4b295
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
      imageID: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:71996bffd7fe18b8273f2926f7b3bb60c900ce30e4cd13dcc2dcac50e7df99f0
      lastState: {}
      name: cert-manager-cainjector
      ready: true
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2025-10-14T13:29:10Z"
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zmnz9
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 192.168.34.10
    hostIPs:
    - ip: 192.168.34.10
    phase: Running
    podIP: 10.130.0.36
    podIPs:
    - ip: 10.130.0.36
    qosClass: BestEffort
    startTime: "2025-10-14T13:29:08Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.130.0.35/23"],"mac_address":"0a:58:0a:82:00:23","gateway_ips":["10.130.0.1"],"routes":[{"dest":"10.128.0.0/14","nextHop":"10.130.0.1"},{"dest":"172.30.0.0/16","nextHop":"10.130.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.130.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.130.0.1"}],"ip_address":"10.130.0.35/23","gateway_ip":"10.130.0.1","role":"primary"}}'
      k8s.v1.cni.cncf.io/network-status: |-
        [{
            "name": "ovn-kubernetes",
            "interface": "eth0",
            "ips": [
                "10.130.0.35"
            ],
            "mac": "0a:58:0a:82:00:23",
            "default": true,
            "dns": {}
        }]
      openshift.io/scc: restricted-v2
      prometheus.io/path: /metrics
      prometheus.io/port: "9402"
      prometheus.io/scrape: "true"
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
    creationTimestamp: "2025-10-14T13:29:04Z"
    generateName: cert-manager-webhook-d969966f-
    labels:
      app: webhook
      app.kubernetes.io/component: webhook
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: webhook
      app.kubernetes.io/version: v1.17.4
      pod-template-hash: d969966f
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:prometheus.io/path: {}
            f:prometheus.io/port: {}
            f:prometheus.io/scrape: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:app.kubernetes.io/component: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/version: {}
            f:pod-template-hash: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"9054db89-ebd2-4fdb-816a-7f018c5572a5"}: {}
        f:spec:
          f:containers:
            k:{"name":"cert-manager-webhook"}:
              .: {}
              f:args: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"POD_NAMESPACE"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:livenessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:name: {}
              f:ports:
                .: {}
                k:{"containerPort":6080,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":9402,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
                k:{"containerPort":10250,"protocol":"TCP"}:
                  .: {}
                  f:containerPort: {}
                  f:name: {}
                  f:protocol: {}
              f:readinessProbe:
                .: {}
                f:failureThreshold: {}
                f:httpGet:
                  .: {}
                  f:path: {}
                  f:port: {}
                  f:scheme: {}
                f:initialDelaySeconds: {}
                f:periodSeconds: {}
                f:successThreshold: {}
                f:timeoutSeconds: {}
              f:resources: {}
              f:securityContext:
                .: {}
                f:allowPrivilegeEscalation: {}
                f:capabilities:
                  .: {}
                  f:drop: {}
                f:readOnlyRootFilesystem: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/var/run/secrets/openshift/serviceaccount"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                  f:readOnly: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:nodeSelector: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext:
            .: {}
            f:runAsNonRoot: {}
            f:seccompProfile:
              .: {}
              f:type: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:volumes:
            .: {}
            k:{"name":"bound-sa-token"}:
              .: {}
              f:name: {}
              f:projected:
                .: {}
                f:defaultMode: {}
                f:sources: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:29:04Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.ovn.org/pod-networks: {}
      manager: master-0
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:04Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:k8s.v1.cni.cncf.io/network-status: {}
      manager: multus-daemon
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:05Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.130.0.35"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2025-10-14T13:29:15Z"
    name: cert-manager-webhook-d969966f-ddrnx
    namespace: cert-manager
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: cert-manager-webhook-d969966f
      uid: 9054db89-ebd2-4fdb-816a-7f018c5572a5
    resourceVersion: "28573"
    uid: dc3a9813-3396-494a-b5ae-729b239c17bd
  spec:
    containers:
    - args:
      - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
      - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
      - --dynamic-serving-dns-names=cert-manager-webhook,cert-manager-webhook.$(POD_NAMESPACE),cert-manager-webhook.$(POD_NAMESPACE).svc
      - --secure-port=10250
      - --v=2
      command:
      - /app/cmd/webhook/webhook
      env:
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
      imagePullPolicy: IfNotPresent
      livenessProbe:
        failureThreshold: 3
        httpGet:
          path: /livez
          port: 6080
          scheme: HTTP
        initialDelaySeconds: 60
        periodSeconds: 10
        successThreshold: 1
        timeoutSeconds: 1
      name: cert-manager-webhook
      ports:
      - containerPort: 10250
        name: https
        protocol: TCP
      - containerPort: 6080
        name: healthcheck
        protocol: TCP
      - containerPort: 9402
        name: http-metrics
        protocol: TCP
      readinessProbe:
        failureThreshold: 3
        httpGet:
          path: /healthz
          port: 6080
          scheme: HTTP
        initialDelaySeconds: 5
        periodSeconds: 5
        successThreshold: 1
        timeoutSeconds: 1
      resources: {}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsUser: 1000780000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: File
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-f7sqw
        readOnly: true
    dnsPolicy: ClusterFirst
    enableServiceLinks: false
    nodeName: master-0
    nodeSelector:
      kubernetes.io/os: linux
    preemptionPolicy: PreemptLowerPriority
    priority: 0
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000780000
      runAsNonRoot: true
      seLinuxOptions:
        level: s0:c28,c12
      seccompProfile:
        type: RuntimeDefault
    serviceAccount: cert-manager-webhook
    serviceAccountName: cert-manager-webhook
    terminationGracePeriodSeconds: 30
    tolerations:
    - effect: NoExecute
      key: node.kubernetes.io/not-ready
      operator: Exists
      tolerationSeconds: 300
    - effect: NoExecute
      key: node.kubernetes.io/unreachable
      operator: Exists
      tolerationSeconds: 300
    volumes:
    - name: bound-sa-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: openshift
            expirationSeconds: 3600
            path: token
    - name: kube-api-access-f7sqw
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:10Z"
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:04Z"
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:14Z"
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:14Z"
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2025-10-14T13:29:04Z"
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://27990a6ec1fc771b7b502c060ad7f9fa91d1b63cc689f7fe4a3fecce980e1220
      image: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
      imageID: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:71996bffd7fe18b8273f2926f7b3bb60c900ce30e4cd13dcc2dcac50e7df99f0
      lastState: {}
      name: cert-manager-webhook
      ready: true
      restartCount: 0
      started: true
      state:
        running:
          startedAt: "2025-10-14T13:29:09Z"
      volumeMounts:
      - mountPath: /var/run/secrets/openshift/serviceaccount
        name: bound-sa-token
        readOnly: true
        recursiveReadOnly: Disabled
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-f7sqw
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 192.168.34.10
    hostIPs:
    - ip: 192.168.34.10
    phase: Running
    podIP: 10.130.0.35
    podIPs:
    - ip: 10.130.0.35
    qosClass: BestEffort
    startTime: "2025-10-14T13:29:04Z"
kind: PodList
metadata:
  resourceVersion: "61428"