---
apiVersion: apps/v1
items:
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "3"
      deployment.kubernetes.io/max-replicas: "3"
      deployment.kubernetes.io/revision: "4"
      openshiftapiservers.operator.openshift.io/operator-pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ef76839c19a20a0e01cdd2b9fd53ae31937d6f478b2c2343679099985fe9e47
      openshiftapiservers.operator.openshift.io/pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
      operator.openshift.io/dep-desired.generation: "4"
      operator.openshift.io/dep-openshift-apiserver.config.configmap: uJHjJw==
      operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
      operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
      operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
      operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
      operator.openshift.io/spec-hash: a7d7b504bca2191363869b42e3e2c493e4b3963931a65381ae0f0a40e254bc66
    creationTimestamp: "2025-10-14T13:12:47Z"
    generation: 5
    labels:
      apiserver: "true"
      app: openshift-apiserver-a
      openshift-apiserver-anti-affinity: "true"
      pod-template-hash: 595d5f74d8
      revision: "1"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:openshiftapiservers.operator.openshift.io/operator-pull-spec: {}
            f:openshiftapiservers.operator.openshift.io/pull-spec: {}
            f:operator.openshift.io/dep-desired.generation: {}
            f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
            f:operator.openshift.io/spec-hash: {}
          f:labels:
            .: {}
            f:apiserver: {}
            f:app: {}
            f:openshift-apiserver-anti-affinity: {}
            f:pod-template-hash: {}
            f:revision: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"dd3db46a-e5a0-4981-b9be-ad34e8644b9a"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:operator.openshift.io/dep-desired.generation: {}
                f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:apiserver: {}
                f:app: {}
                f:openshift-apiserver-anti-affinity: {}
                f:pod-template-hash: {}
                f:revision: {}
              f:name: {}
            f:spec:
              f:affinity:
                .: {}
                f:podAntiAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"openshift-apiserver"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/lib/kubelet/"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/audit"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/etcd-serving-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/image-import-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/trusted-ca-bundle"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/encryption-config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/etcd-client"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/serving-cert"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                k:{"name":"openshift-apiserver-check-endpoints"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":17698,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
              f:dnsPolicy: {}
              f:initContainers:
                .: {}
                k:{"name":"fix-audit-permissions"}:
                  .: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:runAsUser: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"audit"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"audit-dir"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"config"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"encryption-config"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"etcd-client"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"etcd-serving-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"image-import-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"node-pullsecrets"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"serving-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"trusted-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:22:57Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:observedGeneration: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2025-10-14T13:22:58Z"
    name: apiserver-595d5f74d8
    namespace: openshift-apiserver
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: apiserver
      uid: dd3db46a-e5a0-4981-b9be-ad34e8644b9a
    resourceVersion: "23118"
    uid: 6216fb5d-c8b2-4650-88f3-64126fc26b68
  spec:
    replicas: 0
    selector:
      matchLabels:
        apiserver: "true"
        app: openshift-apiserver-a
        pod-template-hash: 595d5f74d8
    template:
      metadata:
        annotations:
          openshift.io/required-scc: privileged
          operator.openshift.io/dep-desired.generation: "4"
          operator.openshift.io/dep-openshift-apiserver.config.configmap: uJHjJw==
          operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
          operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
          operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
          operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          apiserver: "true"
          app: openshift-apiserver-a
          openshift-apiserver-anti-affinity: "true"
          pod-template-hash: 595d5f74d8
          revision: "1"
        name: openshift-apiserver
      spec:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  apiserver: "true"
                  app: openshift-apiserver-a
                  openshift-apiserver-anti-affinity: "true"
              topologyKey: kubernetes.io/hostname
        containers:
        - args:
          - |
            if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            fi
            exec openshift-apiserver start --config=/var/run/configmaps/config/config.yaml -v=2
          command:
          - /bin/bash
          - -ec
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: livez?exclude=etcd
              port: 8443
              scheme: HTTPS
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          name: openshift-apiserver
          ports:
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: readyz?exclude=etcd&exclude=etcd-readiness
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            privileged: true
            readOnlyRootFilesystem: false
            runAsUser: 0
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: livez
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/lib/kubelet/
            name: node-pullsecrets
            readOnly: true
          - mountPath: /var/run/configmaps/config
            name: config
          - mountPath: /var/run/configmaps/audit
            name: audit
          - mountPath: /var/run/secrets/etcd-client
            name: etcd-client
          - mountPath: /var/run/configmaps/etcd-serving-ca
            name: etcd-serving-ca
          - mountPath: /var/run/configmaps/image-import-ca
            name: image-import-ca
          - mountPath: /var/run/configmaps/trusted-ca-bundle
            name: trusted-ca-bundle
          - mountPath: /var/run/secrets/serving-cert
            name: serving-cert
          - mountPath: /var/run/secrets/encryption-config
            name: encryption-config
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        - args:
          - --listen
          - 0.0.0.0:17698
          - --namespace
          - $(POD_NAMESPACE)
          - --v
          - "2"
          command:
          - cluster-kube-apiserver-operator
          - check-endpoints
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:bd52817806c4f947413297672397b0f17784eec91347b8d6f3a21f4b9921eb2e
          imagePullPolicy: IfNotPresent
          name: openshift-apiserver-check-endpoints
          ports:
          - containerPort: 17698
            name: check-endpoints
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
        dnsPolicy: ClusterFirst
        initContainers:
        - command:
          - sh
          - -c
          - chmod 0700 /var/log/openshift-apiserver && touch /var/log/openshift-apiserver/audit.log
            && chmod 0600 /var/log/openshift-apiserver/*
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          name: fix-audit-permissions
          resources:
            requests:
              cpu: 15m
              memory: 50Mi
          securityContext:
            privileged: true
            runAsUser: 0
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        nodeSelector:
          node-role.kubernetes.io/master: ""
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: openshift-apiserver-sa
        serviceAccountName: openshift-apiserver-sa
        terminationGracePeriodSeconds: 120
        tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        volumes:
        - hostPath:
            path: /var/lib/kubelet/
            type: Directory
          name: node-pullsecrets
        - configMap:
            defaultMode: 420
            name: config
          name: config
        - configMap:
            defaultMode: 420
            name: audit-1
          name: audit
        - name: etcd-client
          secret:
            defaultMode: 384
            secretName: etcd-client
        - configMap:
            defaultMode: 420
            name: etcd-serving-ca
          name: etcd-serving-ca
        - configMap:
            defaultMode: 420
            name: image-import-ca
            optional: true
          name: image-import-ca
        - name: serving-cert
          secret:
            defaultMode: 384
            secretName: serving-cert
        - configMap:
            defaultMode: 420
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
            name: trusted-ca-bundle
            optional: true
          name: trusted-ca-bundle
        - name: encryption-config
          secret:
            defaultMode: 384
            optional: true
            secretName: encryption-config-1
        - hostPath:
            path: /var/log/openshift-apiserver
            type: ""
          name: audit-dir
  status:
    observedGeneration: 5
    replicas: 0
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "2"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "1"
      openshiftapiservers.operator.openshift.io/operator-pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ef76839c19a20a0e01cdd2b9fd53ae31937d6f478b2c2343679099985fe9e47
      openshiftapiservers.operator.openshift.io/pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
      operator.openshift.io/dep-desired.generation: "2"
      operator.openshift.io/dep-openshift-apiserver.config.configmap: t--EJg==
      operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
      operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
      operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
      operator.openshift.io/spec-hash: e525021b59acf64cb1f81b4299d0efda10359c91dbaa7d8da7c0ea80eba8a431
    creationTimestamp: "2025-10-14T13:08:22Z"
    generation: 3
    labels:
      apiserver: "true"
      app: openshift-apiserver-a
      openshift-apiserver-anti-affinity: "true"
      pod-template-hash: 5c6d48559d
      revision: "0"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:openshiftapiservers.operator.openshift.io/operator-pull-spec: {}
            f:openshiftapiservers.operator.openshift.io/pull-spec: {}
            f:operator.openshift.io/dep-desired.generation: {}
            f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
            f:operator.openshift.io/spec-hash: {}
          f:labels:
            .: {}
            f:apiserver: {}
            f:app: {}
            f:openshift-apiserver-anti-affinity: {}
            f:pod-template-hash: {}
            f:revision: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"dd3db46a-e5a0-4981-b9be-ad34e8644b9a"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:operator.openshift.io/dep-desired.generation: {}
                f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:apiserver: {}
                f:app: {}
                f:openshift-apiserver-anti-affinity: {}
                f:pod-template-hash: {}
                f:revision: {}
              f:name: {}
            f:spec:
              f:affinity:
                .: {}
                f:podAntiAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"openshift-apiserver"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/lib/kubelet/"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/audit"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/etcd-serving-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/image-import-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/trusted-ca-bundle"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/encryption-config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/etcd-client"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/serving-cert"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                k:{"name":"openshift-apiserver-check-endpoints"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":17698,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
              f:dnsPolicy: {}
              f:initContainers:
                .: {}
                k:{"name":"fix-audit-permissions"}:
                  .: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:runAsUser: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"audit"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"audit-dir"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"config"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"encryption-config"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"etcd-client"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"etcd-serving-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"image-import-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"node-pullsecrets"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"serving-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"trusted-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:08:38Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:observedGeneration: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2025-10-14T13:08:38Z"
    name: apiserver-5c6d48559d
    namespace: openshift-apiserver
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: apiserver
      uid: dd3db46a-e5a0-4981-b9be-ad34e8644b9a
    resourceVersion: "7263"
    uid: 7f40470d-3b51-4ef6-b17a-f90f051c3443
  spec:
    replicas: 0
    selector:
      matchLabels:
        apiserver: "true"
        app: openshift-apiserver-a
        pod-template-hash: 5c6d48559d
    template:
      metadata:
        annotations:
          openshift.io/required-scc: privileged
          operator.openshift.io/dep-desired.generation: "2"
          operator.openshift.io/dep-openshift-apiserver.config.configmap: t--EJg==
          operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
          operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
          operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          apiserver: "true"
          app: openshift-apiserver-a
          openshift-apiserver-anti-affinity: "true"
          pod-template-hash: 5c6d48559d
          revision: "0"
        name: openshift-apiserver
      spec:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  apiserver: "true"
                  app: openshift-apiserver-a
                  openshift-apiserver-anti-affinity: "true"
              topologyKey: kubernetes.io/hostname
        containers:
        - args:
          - |
            if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            fi
            exec openshift-apiserver start --config=/var/run/configmaps/config/config.yaml -v=2
          command:
          - /bin/bash
          - -ec
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: livez?exclude=etcd
              port: 8443
              scheme: HTTPS
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          name: openshift-apiserver
          ports:
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: readyz?exclude=etcd&exclude=etcd-readiness
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            privileged: true
            readOnlyRootFilesystem: false
            runAsUser: 0
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: livez
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/lib/kubelet/
            name: node-pullsecrets
            readOnly: true
          - mountPath: /var/run/configmaps/config
            name: config
          - mountPath: /var/run/configmaps/audit
            name: audit
          - mountPath: /var/run/secrets/etcd-client
            name: etcd-client
          - mountPath: /var/run/configmaps/etcd-serving-ca
            name: etcd-serving-ca
          - mountPath: /var/run/configmaps/image-import-ca
            name: image-import-ca
          - mountPath: /var/run/configmaps/trusted-ca-bundle
            name: trusted-ca-bundle
          - mountPath: /var/run/secrets/serving-cert
            name: serving-cert
          - mountPath: /var/run/secrets/encryption-config
            name: encryption-config
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        - args:
          - --listen
          - 0.0.0.0:17698
          - --namespace
          - $(POD_NAMESPACE)
          - --v
          - "2"
          command:
          - cluster-kube-apiserver-operator
          - check-endpoints
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:bd52817806c4f947413297672397b0f17784eec91347b8d6f3a21f4b9921eb2e
          imagePullPolicy: IfNotPresent
          name: openshift-apiserver-check-endpoints
          ports:
          - containerPort: 17698
            name: check-endpoints
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
        dnsPolicy: ClusterFirst
        initContainers:
        - command:
          - sh
          - -c
          - chmod 0700 /var/log/openshift-apiserver && touch /var/log/openshift-apiserver/audit.log
            && chmod 0600 /var/log/openshift-apiserver/*
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          name: fix-audit-permissions
          resources:
            requests:
              cpu: 15m
              memory: 50Mi
          securityContext:
            privileged: true
            runAsUser: 0
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        nodeSelector:
          node-role.kubernetes.io/master: ""
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: openshift-apiserver-sa
        serviceAccountName: openshift-apiserver-sa
        terminationGracePeriodSeconds: 120
        tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        volumes:
        - hostPath:
            path: /var/lib/kubelet/
            type: Directory
          name: node-pullsecrets
        - configMap:
            defaultMode: 420
            name: config
          name: config
        - configMap:
            defaultMode: 420
            name: audit-0
          name: audit
        - name: etcd-client
          secret:
            defaultMode: 384
            secretName: etcd-client
        - configMap:
            defaultMode: 420
            name: etcd-serving-ca
          name: etcd-serving-ca
        - configMap:
            defaultMode: 420
            name: image-import-ca
            optional: true
          name: image-import-ca
        - name: serving-cert
          secret:
            defaultMode: 384
            secretName: serving-cert
        - configMap:
            defaultMode: 420
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
            name: trusted-ca-bundle
            optional: true
          name: trusted-ca-bundle
        - name: encryption-config
          secret:
            defaultMode: 384
            optional: true
            secretName: encryption-config-0
        - hostPath:
            path: /var/log/openshift-apiserver
            type: ""
          name: audit-dir
  status:
    observedGeneration: 3
    replicas: 0
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "3"
      deployment.kubernetes.io/max-replicas: "3"
      deployment.kubernetes.io/revision: "5"
      openshiftapiservers.operator.openshift.io/operator-pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ef76839c19a20a0e01cdd2b9fd53ae31937d6f478b2c2343679099985fe9e47
      openshiftapiservers.operator.openshift.io/pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
      operator.openshift.io/dep-desired.generation: "5"
      operator.openshift.io/dep-openshift-apiserver.config.configmap: UbBTnA==
      operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
      operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
      operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
      operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
      operator.openshift.io/spec-hash: 5a31d9b49561239c8f6f49c4038e0855770933c5ef3188270468f2255bba9dc5
    creationTimestamp: "2025-10-14T13:20:01Z"
    generation: 7
    labels:
      apiserver: "true"
      app: openshift-apiserver-a
      openshift-apiserver-anti-affinity: "true"
      pod-template-hash: 5f68d4c887
      revision: "1"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:openshiftapiservers.operator.openshift.io/operator-pull-spec: {}
            f:openshiftapiservers.operator.openshift.io/pull-spec: {}
            f:operator.openshift.io/dep-desired.generation: {}
            f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
            f:operator.openshift.io/spec-hash: {}
          f:labels:
            .: {}
            f:apiserver: {}
            f:app: {}
            f:openshift-apiserver-anti-affinity: {}
            f:pod-template-hash: {}
            f:revision: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"dd3db46a-e5a0-4981-b9be-ad34e8644b9a"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:operator.openshift.io/dep-desired.generation: {}
                f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:apiserver: {}
                f:app: {}
                f:openshift-apiserver-anti-affinity: {}
                f:pod-template-hash: {}
                f:revision: {}
              f:name: {}
            f:spec:
              f:affinity:
                .: {}
                f:podAntiAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"openshift-apiserver"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/lib/kubelet/"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/audit"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/etcd-serving-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/image-import-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/trusted-ca-bundle"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/encryption-config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/etcd-client"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/serving-cert"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                k:{"name":"openshift-apiserver-check-endpoints"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":17698,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
              f:dnsPolicy: {}
              f:initContainers:
                .: {}
                k:{"name":"fix-audit-permissions"}:
                  .: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:runAsUser: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"audit"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"audit-dir"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"config"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"encryption-config"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"etcd-client"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"etcd-serving-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"image-import-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"node-pullsecrets"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"serving-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"trusted-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:26:54Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:observedGeneration: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2025-10-14T13:26:54Z"
    name: apiserver-5f68d4c887
    namespace: openshift-apiserver
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: apiserver
      uid: dd3db46a-e5a0-4981-b9be-ad34e8644b9a
    resourceVersion: "25672"
    uid: 6de5e852-e767-4f98-902c-1c9ba8ee7d79
  spec:
    replicas: 0
    selector:
      matchLabels:
        apiserver: "true"
        app: openshift-apiserver-a
        pod-template-hash: 5f68d4c887
    template:
      metadata:
        annotations:
          openshift.io/required-scc: privileged
          operator.openshift.io/dep-desired.generation: "5"
          operator.openshift.io/dep-openshift-apiserver.config.configmap: UbBTnA==
          operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
          operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
          operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
          operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          apiserver: "true"
          app: openshift-apiserver-a
          openshift-apiserver-anti-affinity: "true"
          pod-template-hash: 5f68d4c887
          revision: "1"
        name: openshift-apiserver
      spec:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  apiserver: "true"
                  app: openshift-apiserver-a
                  openshift-apiserver-anti-affinity: "true"
              topologyKey: kubernetes.io/hostname
        containers:
        - args:
          - |
            if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            fi
            exec openshift-apiserver start --config=/var/run/configmaps/config/config.yaml -v=2
          command:
          - /bin/bash
          - -ec
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: livez?exclude=etcd
              port: 8443
              scheme: HTTPS
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          name: openshift-apiserver
          ports:
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: readyz?exclude=etcd&exclude=etcd-readiness
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            privileged: true
            readOnlyRootFilesystem: false
            runAsUser: 0
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: livez
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/lib/kubelet/
            name: node-pullsecrets
            readOnly: true
          - mountPath: /var/run/configmaps/config
            name: config
          - mountPath: /var/run/configmaps/audit
            name: audit
          - mountPath: /var/run/secrets/etcd-client
            name: etcd-client
          - mountPath: /var/run/configmaps/etcd-serving-ca
            name: etcd-serving-ca
          - mountPath: /var/run/configmaps/image-import-ca
            name: image-import-ca
          - mountPath: /var/run/configmaps/trusted-ca-bundle
            name: trusted-ca-bundle
          - mountPath: /var/run/secrets/serving-cert
            name: serving-cert
          - mountPath: /var/run/secrets/encryption-config
            name: encryption-config
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        - args:
          - --listen
          - 0.0.0.0:17698
          - --namespace
          - $(POD_NAMESPACE)
          - --v
          - "2"
          command:
          - cluster-kube-apiserver-operator
          - check-endpoints
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:bd52817806c4f947413297672397b0f17784eec91347b8d6f3a21f4b9921eb2e
          imagePullPolicy: IfNotPresent
          name: openshift-apiserver-check-endpoints
          ports:
          - containerPort: 17698
            name: check-endpoints
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
        dnsPolicy: ClusterFirst
        initContainers:
        - command:
          - sh
          - -c
          - chmod 0700 /var/log/openshift-apiserver && touch /var/log/openshift-apiserver/audit.log
            && chmod 0600 /var/log/openshift-apiserver/*
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          name: fix-audit-permissions
          resources:
            requests:
              cpu: 15m
              memory: 50Mi
          securityContext:
            privileged: true
            runAsUser: 0
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        nodeSelector:
          node-role.kubernetes.io/master: ""
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: openshift-apiserver-sa
        serviceAccountName: openshift-apiserver-sa
        terminationGracePeriodSeconds: 120
        tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        volumes:
        - hostPath:
            path: /var/lib/kubelet/
            type: Directory
          name: node-pullsecrets
        - configMap:
            defaultMode: 420
            name: config
          name: config
        - configMap:
            defaultMode: 420
            name: audit-1
          name: audit
        - name: etcd-client
          secret:
            defaultMode: 384
            secretName: etcd-client
        - configMap:
            defaultMode: 420
            name: etcd-serving-ca
          name: etcd-serving-ca
        - configMap:
            defaultMode: 420
            name: image-import-ca
            optional: true
          name: image-import-ca
        - name: serving-cert
          secret:
            defaultMode: 384
            secretName: serving-cert
        - configMap:
            defaultMode: 420
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
            name: trusted-ca-bundle
            optional: true
          name: trusted-ca-bundle
        - name: encryption-config
          secret:
            defaultMode: 384
            optional: true
            secretName: encryption-config-1
        - hostPath:
            path: /var/log/openshift-apiserver
            type: ""
          name: audit-dir
  status:
    observedGeneration: 7
    replicas: 0
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "3"
      deployment.kubernetes.io/max-replicas: "3"
      deployment.kubernetes.io/revision: "6"
      openshiftapiservers.operator.openshift.io/operator-pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ef76839c19a20a0e01cdd2b9fd53ae31937d6f478b2c2343679099985fe9e47
      openshiftapiservers.operator.openshift.io/pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
      operator.openshift.io/dep-desired.generation: "6"
      operator.openshift.io/dep-openshift-apiserver.config.configmap: uJHjJw==
      operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
      operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
      operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
      operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
      operator.openshift.io/spec-hash: 7a1b855f8e9061de0feb5a56a83c350294616640a9cf67d6a3cddce31dd915d9
    creationTimestamp: "2025-10-14T13:24:45Z"
    generation: 4
    labels:
      apiserver: "true"
      app: openshift-apiserver-a
      openshift-apiserver-anti-affinity: "true"
      pod-template-hash: 65499f9774
      revision: "1"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:openshiftapiservers.operator.openshift.io/operator-pull-spec: {}
            f:openshiftapiservers.operator.openshift.io/pull-spec: {}
            f:operator.openshift.io/dep-desired.generation: {}
            f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
            f:operator.openshift.io/spec-hash: {}
          f:labels:
            .: {}
            f:apiserver: {}
            f:app: {}
            f:openshift-apiserver-anti-affinity: {}
            f:pod-template-hash: {}
            f:revision: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"dd3db46a-e5a0-4981-b9be-ad34e8644b9a"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:operator.openshift.io/dep-desired.generation: {}
                f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:apiserver: {}
                f:app: {}
                f:openshift-apiserver-anti-affinity: {}
                f:pod-template-hash: {}
                f:revision: {}
              f:name: {}
            f:spec:
              f:affinity:
                .: {}
                f:podAntiAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"openshift-apiserver"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/lib/kubelet/"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/audit"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/etcd-serving-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/image-import-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/trusted-ca-bundle"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/encryption-config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/etcd-client"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/serving-cert"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                k:{"name":"openshift-apiserver-check-endpoints"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":17698,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
              f:dnsPolicy: {}
              f:initContainers:
                .: {}
                k:{"name":"fix-audit-permissions"}:
                  .: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:runAsUser: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"audit"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"audit-dir"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"config"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"encryption-config"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"etcd-client"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"etcd-serving-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"image-import-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"node-pullsecrets"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"serving-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"trusted-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:26:54Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2025-10-14T13:28:57Z"
    name: apiserver-65499f9774
    namespace: openshift-apiserver
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: apiserver
      uid: dd3db46a-e5a0-4981-b9be-ad34e8644b9a
    resourceVersion: "27407"
    uid: 9c3620aa-fe1c-485d-b5f7-ce6552525665
  spec:
    replicas: 3
    selector:
      matchLabels:
        apiserver: "true"
        app: openshift-apiserver-a
        pod-template-hash: 65499f9774
    template:
      metadata:
        annotations:
          openshift.io/required-scc: privileged
          operator.openshift.io/dep-desired.generation: "6"
          operator.openshift.io/dep-openshift-apiserver.config.configmap: uJHjJw==
          operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
          operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
          operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
          operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          apiserver: "true"
          app: openshift-apiserver-a
          openshift-apiserver-anti-affinity: "true"
          pod-template-hash: 65499f9774
          revision: "1"
        name: openshift-apiserver
      spec:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  apiserver: "true"
                  app: openshift-apiserver-a
                  openshift-apiserver-anti-affinity: "true"
              topologyKey: kubernetes.io/hostname
        containers:
        - args:
          - |
            if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            fi
            exec openshift-apiserver start --config=/var/run/configmaps/config/config.yaml -v=2
          command:
          - /bin/bash
          - -ec
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: livez?exclude=etcd
              port: 8443
              scheme: HTTPS
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          name: openshift-apiserver
          ports:
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: readyz?exclude=etcd&exclude=etcd-readiness
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            privileged: true
            readOnlyRootFilesystem: false
            runAsUser: 0
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: livez
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/lib/kubelet/
            name: node-pullsecrets
            readOnly: true
          - mountPath: /var/run/configmaps/config
            name: config
          - mountPath: /var/run/configmaps/audit
            name: audit
          - mountPath: /var/run/secrets/etcd-client
            name: etcd-client
          - mountPath: /var/run/configmaps/etcd-serving-ca
            name: etcd-serving-ca
          - mountPath: /var/run/configmaps/image-import-ca
            name: image-import-ca
          - mountPath: /var/run/configmaps/trusted-ca-bundle
            name: trusted-ca-bundle
          - mountPath: /var/run/secrets/serving-cert
            name: serving-cert
          - mountPath: /var/run/secrets/encryption-config
            name: encryption-config
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        - args:
          - --listen
          - 0.0.0.0:17698
          - --namespace
          - $(POD_NAMESPACE)
          - --v
          - "2"
          command:
          - cluster-kube-apiserver-operator
          - check-endpoints
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:bd52817806c4f947413297672397b0f17784eec91347b8d6f3a21f4b9921eb2e
          imagePullPolicy: IfNotPresent
          name: openshift-apiserver-check-endpoints
          ports:
          - containerPort: 17698
            name: check-endpoints
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
        dnsPolicy: ClusterFirst
        initContainers:
        - command:
          - sh
          - -c
          - chmod 0700 /var/log/openshift-apiserver && touch /var/log/openshift-apiserver/audit.log
            && chmod 0600 /var/log/openshift-apiserver/*
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          name: fix-audit-permissions
          resources:
            requests:
              cpu: 15m
              memory: 50Mi
          securityContext:
            privileged: true
            runAsUser: 0
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        nodeSelector:
          node-role.kubernetes.io/master: ""
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: openshift-apiserver-sa
        serviceAccountName: openshift-apiserver-sa
        terminationGracePeriodSeconds: 120
        tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        volumes:
        - hostPath:
            path: /var/lib/kubelet/
            type: Directory
          name: node-pullsecrets
        - configMap:
            defaultMode: 420
            name: config
          name: config
        - configMap:
            defaultMode: 420
            name: audit-1
          name: audit
        - name: etcd-client
          secret:
            defaultMode: 384
            secretName: etcd-client
        - configMap:
            defaultMode: 420
            name: etcd-serving-ca
          name: etcd-serving-ca
        - configMap:
            defaultMode: 420
            name: image-import-ca
            optional: true
          name: image-import-ca
        - name: serving-cert
          secret:
            defaultMode: 384
            secretName: serving-cert
        - configMap:
            defaultMode: 420
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
            name: trusted-ca-bundle
            optional: true
          name: trusted-ca-bundle
        - name: encryption-config
          secret:
            defaultMode: 384
            optional: true
            secretName: encryption-config-1
        - hostPath:
            path: /var/log/openshift-apiserver
            type: ""
          name: audit-dir
  status:
    availableReplicas: 3
    fullyLabeledReplicas: 3
    observedGeneration: 4
    readyReplicas: 3
    replicas: 3
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "2"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "2"
      openshiftapiservers.operator.openshift.io/operator-pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ef76839c19a20a0e01cdd2b9fd53ae31937d6f478b2c2343679099985fe9e47
      openshiftapiservers.operator.openshift.io/pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
      operator.openshift.io/dep-desired.generation: "2"
      operator.openshift.io/dep-openshift-apiserver.config.configmap: t--EJg==
      operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
      operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
      operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
      operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
      operator.openshift.io/spec-hash: 15ed944001cf8f16b71cd371df9e0fc609a5cd7f79739e13a11a5bf0bc1cedce
    creationTimestamp: "2025-10-14T13:08:26Z"
    generation: 5
    labels:
      apiserver: "true"
      app: openshift-apiserver-a
      openshift-apiserver-anti-affinity: "true"
      pod-template-hash: 6576f6bc9d
      revision: "1"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:openshiftapiservers.operator.openshift.io/operator-pull-spec: {}
            f:openshiftapiservers.operator.openshift.io/pull-spec: {}
            f:operator.openshift.io/dep-desired.generation: {}
            f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
            f:operator.openshift.io/spec-hash: {}
          f:labels:
            .: {}
            f:apiserver: {}
            f:app: {}
            f:openshift-apiserver-anti-affinity: {}
            f:pod-template-hash: {}
            f:revision: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"dd3db46a-e5a0-4981-b9be-ad34e8644b9a"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:operator.openshift.io/dep-desired.generation: {}
                f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:apiserver: {}
                f:app: {}
                f:openshift-apiserver-anti-affinity: {}
                f:pod-template-hash: {}
                f:revision: {}
              f:name: {}
            f:spec:
              f:affinity:
                .: {}
                f:podAntiAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"openshift-apiserver"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/lib/kubelet/"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/audit"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/etcd-serving-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/image-import-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/trusted-ca-bundle"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/encryption-config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/etcd-client"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/serving-cert"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                k:{"name":"openshift-apiserver-check-endpoints"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":17698,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
              f:dnsPolicy: {}
              f:initContainers:
                .: {}
                k:{"name":"fix-audit-permissions"}:
                  .: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:runAsUser: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"audit"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"audit-dir"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"config"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"encryption-config"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"etcd-client"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"etcd-serving-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"image-import-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"node-pullsecrets"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"serving-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"trusted-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:11:50Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:observedGeneration: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2025-10-14T13:11:50Z"
    name: apiserver-6576f6bc9d
    namespace: openshift-apiserver
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: apiserver
      uid: dd3db46a-e5a0-4981-b9be-ad34e8644b9a
    resourceVersion: "12055"
    uid: b1701afb-55c1-4861-8ac9-c77a64bcdd63
  spec:
    replicas: 0
    selector:
      matchLabels:
        apiserver: "true"
        app: openshift-apiserver-a
        pod-template-hash: 6576f6bc9d
    template:
      metadata:
        annotations:
          openshift.io/required-scc: privileged
          operator.openshift.io/dep-desired.generation: "2"
          operator.openshift.io/dep-openshift-apiserver.config.configmap: t--EJg==
          operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
          operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
          operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
          operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          apiserver: "true"
          app: openshift-apiserver-a
          openshift-apiserver-anti-affinity: "true"
          pod-template-hash: 6576f6bc9d
          revision: "1"
        name: openshift-apiserver
      spec:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  apiserver: "true"
                  app: openshift-apiserver-a
                  openshift-apiserver-anti-affinity: "true"
              topologyKey: kubernetes.io/hostname
        containers:
        - args:
          - |
            if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            fi
            exec openshift-apiserver start --config=/var/run/configmaps/config/config.yaml -v=2
          command:
          - /bin/bash
          - -ec
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: livez?exclude=etcd
              port: 8443
              scheme: HTTPS
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          name: openshift-apiserver
          ports:
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: readyz?exclude=etcd&exclude=etcd-readiness
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            privileged: true
            readOnlyRootFilesystem: false
            runAsUser: 0
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: livez
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/lib/kubelet/
            name: node-pullsecrets
            readOnly: true
          - mountPath: /var/run/configmaps/config
            name: config
          - mountPath: /var/run/configmaps/audit
            name: audit
          - mountPath: /var/run/secrets/etcd-client
            name: etcd-client
          - mountPath: /var/run/configmaps/etcd-serving-ca
            name: etcd-serving-ca
          - mountPath: /var/run/configmaps/image-import-ca
            name: image-import-ca
          - mountPath: /var/run/configmaps/trusted-ca-bundle
            name: trusted-ca-bundle
          - mountPath: /var/run/secrets/serving-cert
            name: serving-cert
          - mountPath: /var/run/secrets/encryption-config
            name: encryption-config
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        - args:
          - --listen
          - 0.0.0.0:17698
          - --namespace
          - $(POD_NAMESPACE)
          - --v
          - "2"
          command:
          - cluster-kube-apiserver-operator
          - check-endpoints
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:bd52817806c4f947413297672397b0f17784eec91347b8d6f3a21f4b9921eb2e
          imagePullPolicy: IfNotPresent
          name: openshift-apiserver-check-endpoints
          ports:
          - containerPort: 17698
            name: check-endpoints
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
        dnsPolicy: ClusterFirst
        initContainers:
        - command:
          - sh
          - -c
          - chmod 0700 /var/log/openshift-apiserver && touch /var/log/openshift-apiserver/audit.log
            && chmod 0600 /var/log/openshift-apiserver/*
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          name: fix-audit-permissions
          resources:
            requests:
              cpu: 15m
              memory: 50Mi
          securityContext:
            privileged: true
            runAsUser: 0
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        nodeSelector:
          node-role.kubernetes.io/master: ""
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: openshift-apiserver-sa
        serviceAccountName: openshift-apiserver-sa
        terminationGracePeriodSeconds: 120
        tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        volumes:
        - hostPath:
            path: /var/lib/kubelet/
            type: Directory
          name: node-pullsecrets
        - configMap:
            defaultMode: 420
            name: config
          name: config
        - configMap:
            defaultMode: 420
            name: audit-1
          name: audit
        - name: etcd-client
          secret:
            defaultMode: 384
            secretName: etcd-client
        - configMap:
            defaultMode: 420
            name: etcd-serving-ca
          name: etcd-serving-ca
        - configMap:
            defaultMode: 420
            name: image-import-ca
            optional: true
          name: image-import-ca
        - name: serving-cert
          secret:
            defaultMode: 384
            secretName: serving-cert
        - configMap:
            defaultMode: 420
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
            name: trusted-ca-bundle
            optional: true
          name: trusted-ca-bundle
        - name: encryption-config
          secret:
            defaultMode: 384
            optional: true
            secretName: encryption-config-1
        - hostPath:
            path: /var/log/openshift-apiserver
            type: ""
          name: audit-dir
  status:
    observedGeneration: 5
    replicas: 0
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "2"
      deployment.kubernetes.io/max-replicas: "2"
      deployment.kubernetes.io/revision: "3"
      openshiftapiservers.operator.openshift.io/operator-pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9ef76839c19a20a0e01cdd2b9fd53ae31937d6f478b2c2343679099985fe9e47
      openshiftapiservers.operator.openshift.io/pull-spec: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
      operator.openshift.io/dep-desired.generation: "3"
      operator.openshift.io/dep-openshift-apiserver.config.configmap: ndeOkA==
      operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
      operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
      operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
      operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
      operator.openshift.io/spec-hash: 41a29bb93a6df28ab4a978fe0e3c7b56689c6b52d17f017e0d976f437e0a11d0
    creationTimestamp: "2025-10-14T13:10:45Z"
    generation: 5
    labels:
      apiserver: "true"
      app: openshift-apiserver-a
      openshift-apiserver-anti-affinity: "true"
      pod-template-hash: 8644c46667
      revision: "1"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:openshiftapiservers.operator.openshift.io/operator-pull-spec: {}
            f:openshiftapiservers.operator.openshift.io/pull-spec: {}
            f:operator.openshift.io/dep-desired.generation: {}
            f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
            f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
            f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
            f:operator.openshift.io/spec-hash: {}
          f:labels:
            .: {}
            f:apiserver: {}
            f:app: {}
            f:openshift-apiserver-anti-affinity: {}
            f:pod-template-hash: {}
            f:revision: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"dd3db46a-e5a0-4981-b9be-ad34e8644b9a"}: {}
        f:spec:
          f:replicas: {}
          f:selector: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:openshift.io/required-scc: {}
                f:operator.openshift.io/dep-desired.generation: {}
                f:operator.openshift.io/dep-openshift-apiserver.config.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: {}
                f:operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: {}
                f:operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: {}
                f:target.workload.openshift.io/management: {}
              f:labels:
                .: {}
                f:apiserver: {}
                f:app: {}
                f:openshift-apiserver-anti-affinity: {}
                f:pod-template-hash: {}
                f:revision: {}
              f:name: {}
            f:spec:
              f:affinity:
                .: {}
                f:podAntiAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"openshift-apiserver"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:readOnlyRootFilesystem: {}
                    f:runAsUser: {}
                  f:startupProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/lib/kubelet/"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/audit"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/etcd-serving-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/image-import-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/trusted-ca-bundle"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/encryption-config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/etcd-client"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/serving-cert"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                k:{"name":"openshift-apiserver-check-endpoints"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"POD_NAME"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                    k:{"name":"POD_NAMESPACE"}:
                      .: {}
                      f:name: {}
                      f:valueFrom:
                        .: {}
                        f:fieldRef: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":17698,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
              f:dnsPolicy: {}
              f:initContainers:
                .: {}
                k:{"name":"fix-audit-permissions"}:
                  .: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                    f:runAsUser: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/openshift-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:nodeSelector: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"audit"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"audit-dir"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"config"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"encryption-config"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"etcd-client"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"etcd-serving-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"image-import-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
                k:{"name":"node-pullsecrets"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"serving-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"trusted-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-14T13:12:53Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:observedGeneration: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      subresource: status
      time: "2025-10-14T13:12:53Z"
    name: apiserver-8644c46667
    namespace: openshift-apiserver
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: apiserver
      uid: dd3db46a-e5a0-4981-b9be-ad34e8644b9a
    resourceVersion: "14318"
    uid: ac5df668-debc-4927-b429-b67fd97472d6
  spec:
    replicas: 0
    selector:
      matchLabels:
        apiserver: "true"
        app: openshift-apiserver-a
        pod-template-hash: 8644c46667
    template:
      metadata:
        annotations:
          openshift.io/required-scc: privileged
          operator.openshift.io/dep-desired.generation: "3"
          operator.openshift.io/dep-openshift-apiserver.config.configmap: ndeOkA==
          operator.openshift.io/dep-openshift-apiserver.etcd-client.secret: TMbvDA==
          operator.openshift.io/dep-openshift-apiserver.etcd-serving-ca.configmap: T_7ZWg==
          operator.openshift.io/dep-openshift-apiserver.image-import-ca.configmap: OUXnWA==
          operator.openshift.io/dep-openshift-apiserver.trusted-ca-bundle.configmap: ElMHxA==
          target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
        creationTimestamp: null
        labels:
          apiserver: "true"
          app: openshift-apiserver-a
          openshift-apiserver-anti-affinity: "true"
          pod-template-hash: 8644c46667
          revision: "1"
        name: openshift-apiserver
      spec:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  apiserver: "true"
                  app: openshift-apiserver-a
                  openshift-apiserver-anti-affinity: "true"
              topologyKey: kubernetes.io/hostname
        containers:
        - args:
          - |
            if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            fi
            exec openshift-apiserver start --config=/var/run/configmaps/config/config.yaml -v=2
          command:
          - /bin/bash
          - -ec
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: livez?exclude=etcd
              port: 8443
              scheme: HTTPS
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          name: openshift-apiserver
          ports:
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: readyz?exclude=etcd&exclude=etcd-readiness
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          securityContext:
            privileged: true
            readOnlyRootFilesystem: false
            runAsUser: 0
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: livez
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 10
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/lib/kubelet/
            name: node-pullsecrets
            readOnly: true
          - mountPath: /var/run/configmaps/config
            name: config
          - mountPath: /var/run/configmaps/audit
            name: audit
          - mountPath: /var/run/secrets/etcd-client
            name: etcd-client
          - mountPath: /var/run/configmaps/etcd-serving-ca
            name: etcd-serving-ca
          - mountPath: /var/run/configmaps/image-import-ca
            name: image-import-ca
          - mountPath: /var/run/configmaps/trusted-ca-bundle
            name: trusted-ca-bundle
          - mountPath: /var/run/secrets/serving-cert
            name: serving-cert
          - mountPath: /var/run/secrets/encryption-config
            name: encryption-config
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        - args:
          - --listen
          - 0.0.0.0:17698
          - --namespace
          - $(POD_NAMESPACE)
          - --v
          - "2"
          command:
          - cluster-kube-apiserver-operator
          - check-endpoints
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:bd52817806c4f947413297672397b0f17784eec91347b8d6f3a21f4b9921eb2e
          imagePullPolicy: IfNotPresent
          name: openshift-apiserver-check-endpoints
          ports:
          - containerPort: 17698
            name: check-endpoints
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
        dnsPolicy: ClusterFirst
        initContainers:
        - command:
          - sh
          - -c
          - chmod 0700 /var/log/openshift-apiserver && touch /var/log/openshift-apiserver/audit.log
            && chmod 0600 /var/log/openshift-apiserver/*
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:db6d4edac103c373eb6bee221074d39e3707377b4d26444e98afb1a1363b3cb7
          imagePullPolicy: IfNotPresent
          name: fix-audit-permissions
          resources:
            requests:
              cpu: 15m
              memory: 50Mi
          securityContext:
            privileged: true
            runAsUser: 0
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/log/openshift-apiserver
            name: audit-dir
        nodeSelector:
          node-role.kubernetes.io/master: ""
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: openshift-apiserver-sa
        serviceAccountName: openshift-apiserver-sa
        terminationGracePeriodSeconds: 120
        tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node-role.kubernetes.io/control-plane
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        volumes:
        - hostPath:
            path: /var/lib/kubelet/
            type: Directory
          name: node-pullsecrets
        - configMap:
            defaultMode: 420
            name: config
          name: config
        - configMap:
            defaultMode: 420
            name: audit-1
          name: audit
        - name: etcd-client
          secret:
            defaultMode: 384
            secretName: etcd-client
        - configMap:
            defaultMode: 420
            name: etcd-serving-ca
          name: etcd-serving-ca
        - configMap:
            defaultMode: 420
            name: image-import-ca
            optional: true
          name: image-import-ca
        - name: serving-cert
          secret:
            defaultMode: 384
            secretName: serving-cert
        - configMap:
            defaultMode: 420
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
            name: trusted-ca-bundle
            optional: true
          name: trusted-ca-bundle
        - name: encryption-config
          secret:
            defaultMode: 384
            optional: true
            secretName: encryption-config-1
        - hostPath:
            path: /var/log/openshift-apiserver
            type: ""
          name: audit-dir
  status:
    observedGeneration: 5
    replicas: 0
kind: ReplicaSetList
metadata:
  resourceVersion: "61770"