apiVersion: v1
kind: Pod
metadata:
  annotations:
    cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: bootstrap-manifests,logs
    hypershift.openshift.io/aescbc-key-hash: "3600837548"
    hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release@sha256:7111fb4cec202cb758f58d9bed95a67e7fdc417353ef15be56d7bf96356909d4
    k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.128.243.32/24"],"mac_address":"0a:58:0a:80:f3:20","gateway_ips":["10.128.243.1"],"routes":[{"dest":"10.128.0.0/16","nextHop":"10.128.243.1"},{"dest":"172.30.0.0/16","nextHop":"10.128.243.1"},{"dest":"100.64.0.0/16","nextHop":"10.128.243.1"}],"ip_address":"10.128.243.32/24","gateway_ip":"10.128.243.1"}}'
    kube-apiserver.hypershift.openshift.io/audit-config-hash: 9d1e8544bd7678887a86a17431b37786
    kube-apiserver.hypershift.openshift.io/auth-config-hash: 2953cb38b75b2467c67198e6d42d6184
    kube-apiserver.hypershift.openshift.io/config-hash: 69fad9711304666ae9816906064eaaf1
    openshift.io/scc: restricted-v2
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
  creationTimestamp: "2024-05-23T14:58:20Z"
  generateName: kube-apiserver-f96b8b65-
  labels:
    app: kube-apiserver
    hypershift.openshift.io/control-plane-component: kube-apiserver
    hypershift.openshift.io/hosted-control-plane: ocm-staging-2begj3rejmrhokojq2e8c89tbbs1teit-perf-dry-0036
    hypershift.openshift.io/request-serving-component: "true"
    pod-template-hash: f96b8b65
  name: kube-apiserver-f96b8b65-nkkls
  namespace: ocm-staging-2begj3rejmrhokojq2e8c89tbbs1teit-perf-dry-0036
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: kube-apiserver-f96b8b65
    uid: a15d678a-f828-4005-9f12-4c5ba6470ebb
  resourceVersion: "32258594"
  uid: 2d6e6cfe-6bea-4f3b-a373-6a55d1d90b30
spec:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - preference:
          matchExpressions:
          - key: hypershift.openshift.io/control-plane
            operator: In
            values:
            - "true"
        weight: 50
      - preference:
          matchExpressions:
          - key: hypershift.openshift.io/cluster
            operator: In
            values:
            - ocm-staging-2begj3rejmrhokojq2e8c89tbbs1teit-perf-dry-0036
        weight: 100
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: hypershift.openshift.io/request-serving-component
            operator: In
            values:
            - "true"
          - key: hypershift.openshift.io/cluster
            operator: In
            values:
            - ocm-staging-2begj3rejmrhokojq2e8c89tbbs1teit-perf-dry-0036
    podAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - podAffinityTerm:
          labelSelector:
            matchLabels:
              hypershift.openshift.io/hosted-control-plane: ocm-staging-2begj3rejmrhokojq2e8c89tbbs1teit-perf-dry-0036
          topologyKey: kubernetes.io/hostname
        weight: 100
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app: kube-apiserver
            hypershift.openshift.io/control-plane-component: kube-apiserver
        topologyKey: topology.kubernetes.io/zone
      - labelSelector:
          matchLabels:
            app: kube-apiserver
            hypershift.openshift.io/control-plane-component: kube-apiserver
        topologyKey: kubernetes.io/hostname
  automountServiceAccountToken: false
  containers:
  - args:
    - -c
    - |
      #!/bin/sh
      while true; do
        if oc apply -f /work; then
          echo "Bootstrap manifests applied successfully."
          break
        fi
        sleep 1
      done
      while true; do
        if oc replace --subresource=status -f /work/99_feature-gate.yaml; then
          echo "FeatureGate status applied successfully."
          break
        fi
        sleep 1
      done
      while true; do
        sleep 1000
      done
    command:
    - /bin/bash
    env:
    - name: KUBECONFIG
      value: /var/secrets/localhost-kubeconfig/kubeconfig
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:879c6a69fc3c221dd4e01685bf90c1e5a85fab683b308e2a4ea97302f3c42c4e
    imagePullPolicy: IfNotPresent
    name: apply-bootstrap
    resources:
      requests:
        cpu: 10m
        memory: 10Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1002400000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /work
      name: bootstrap-manifests
    - mountPath: /var/secrets/localhost-kubeconfig
      name: localhost-kubeconfig
  - args:
    - kube-apiserver
    - --openshift-config=/etc/kubernetes/config/config.json
    - -v2
    - --encryption-provider-config=/etc/kubernetes/secret-encryption/config.yaml
    command:
    - hyperkube
    env:
    - name: HOST_IP
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: status.podIP
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:713ad26ca7e13952cbb0c4815eef1fc49f4738cd09e2ca961545ee377d7226fe
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 6
      httpGet:
        path: livez?exclude=etcd
        port: client
        scheme: HTTPS
      initialDelaySeconds: 300
      periodSeconds: 180
      successThreshold: 1
      timeoutSeconds: 160
    name: kube-apiserver
    ports:
    - containerPort: 6443
      name: client
      protocol: TCP
    readinessProbe:
      failureThreshold: 6
      httpGet:
        path: readyz
        port: client
        scheme: HTTPS
      initialDelaySeconds: 15
      periodSeconds: 30
      successThreshold: 1
      timeoutSeconds: 120
    resources:
      requests:
        cpu: 350m
        memory: 2Gi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1002400000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /etc/kubernetes/certs/aggregator-ca
      name: aggregator-ca
    - mountPath: /etc/kubernetes/certs/aggregator
      name: aggregator-crt
    - mountPath: /etc/kubernetes/audit
      name: audit-config
    - mountPath: /etc/kubernetes/auth
      name: auth-config
    - mountPath: /etc/kubernetes/auth-token-webhook
      name: auth-token-webhook-config
    - mountPath: /etc/kubernetes/certs/client-ca
      name: client-ca
    - mountPath: /etc/kubernetes/egress-selector
      name: egress-selector-config
    - mountPath: /etc/kubernetes/certs/etcd-ca
      name: etcd-ca
    - mountPath: /etc/kubernetes/certs/etcd
      name: etcd-client-crt
    - mountPath: /etc/kubernetes/config
      name: kas-config
    - mountPath: /etc/kubernetes/certs/konnectivity-ca
      name: konnectivity-ca
    - mountPath: /etc/kubernetes/certs/konnectivity-client
      name: konnectivity-client
    - mountPath: /etc/kubernetes/certs/kubelet-ca
      name: kubelet-client-ca
    - mountPath: /etc/kubernetes/certs/kubelet
      name: kubelet-client-crt
    - mountPath: /var/log/kube-apiserver
      name: logs
    - mountPath: /etc/kubernetes/oauth
      name: oauth-metadata
    - mountPath: /etc/kubernetes/certs/server
      name: server-crt
    - mountPath: /etc/kubernetes/secrets/svcacct-key
      name: svcacct-key
    - mountPath: /etc/kubernetes/certs/named-1
      name: named-cert-1
    - mountPath: /etc/kubernetes/auditwebhook
      name: kas-audit-webhook
    - mountPath: /etc/kubernetes/secret-encryption
      name: kas-secret-encryption-config
    workingDir: /var/log/kube-apiserver
  - args:
    - --logtostderr=true
    - --log-file-max-size=0
    - --cluster-cert
    - /etc/konnectivity/cluster/tls.crt
    - --cluster-key
    - /etc/konnectivity/cluster/tls.key
    - --server-cert
    - /etc/konnectivity/server/tls.crt
    - --server-key
    - /etc/konnectivity/server/tls.key
    - --server-ca-cert
    - /etc/konnectivity/ca/ca.crt
    - --server-port
    - "8090"
    - --agent-port
    - "8091"
    - --health-port
    - "2041"
    - --admin-port=8093
    - --mode=http-connect
    - --proxy-strategies=destHost,defaultRoute
    - --keepalive-time
    - 30s
    - --frontend-keepalive-time
    - 30s
    - --server-count
    - "2"
    - --cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
    command:
    - /usr/bin/proxy-server
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ab4810118ddc7ed3e25fd6535579a6c895c71eefe1dae6f2c8c48086af084f96
    imagePullPolicy: IfNotPresent
    lifecycle:
      preStop:
        exec:
          command:
          - /bin/sh
          - -c
          - sleep 70
    livenessProbe:
      failureThreshold: 3
      httpGet:
        path: healthz
        port: 2041
        scheme: HTTP
      initialDelaySeconds: 120
      periodSeconds: 60
      successThreshold: 1
      timeoutSeconds: 30
    name: konnectivity-server
    readinessProbe:
      failureThreshold: 3
      httpGet:
        path: healthz
        port: 2041
        scheme: HTTP
      initialDelaySeconds: 15
      periodSeconds: 60
      successThreshold: 1
      timeoutSeconds: 5
    resources:
      requests:
        cpu: 10m
        memory: 50Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1002400000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /etc/konnectivity/cluster
      name: cluster-certs
    - mountPath: /etc/konnectivity/ca
      name: konnectivity-ca
    - mountPath: /etc/konnectivity/server
      name: server-certs
  - command:
    - /usr/bin/tail
    - -c+1
    - -F
    - /var/log/kube-apiserver/audit.log
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:879c6a69fc3c221dd4e01685bf90c1e5a85fab683b308e2a4ea97302f3c42c4e
    imagePullPolicy: IfNotPresent
    name: audit-logs
    resources:
      requests:
        cpu: 5m
        memory: 10Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1002400000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/log/kube-apiserver
      name: logs
  - command:
    - /usr/bin/aws-pod-identity-webhook
    - --annotation-prefix=eks.amazonaws.com
    - --in-cluster=false
    - --kubeconfig=/var/run/app/kubeconfig/kubeconfig
    - --logtostderr
    - --port=4443
    - --aws-default-region=us-east-2
    - --tls-cert=/var/run/app/certs/tls.crt
    - --tls-key=/var/run/app/certs/tls.key
    - --token-audience=openshift
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a42c0b392de386e32a5d3ef2055c3ed48bd2bc8ee653f4f89b7c288571e49bc
    imagePullPolicy: IfNotPresent
    name: aws-pod-identity-webhook
    resources:
      requests:
        cpu: 10m
        memory: 25Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1002400000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/app/certs
      name: aws-pod-identity-webhook-serving-certs
    - mountPath: /var/run/app/kubeconfig
      name: aws-pod-identity-webhook-kubeconfig
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  imagePullSecrets:
  - name: default-dockercfg-8jx86
  - name: pull-secret
  initContainers:
  - args:
    - -c
    - |
      #!/bin/sh
      cd /tmp
      mkdir input output manifests

      touch /tmp/manifests/99_feature-gate.yaml
      cat <<EOF >/tmp/manifests/99_feature-gate.yaml
      apiVersion: config.openshift.io/v1
      kind: FeatureGate
      metadata:
        creationTimestamp: null
        name: cluster
      spec: {}
      status:
        featureGates: null

      EOF

      /usr/bin/render \
         --asset-output-dir /tmp/output \
         --rendered-manifest-dir=/tmp/manifests \
         --cluster-profile=ibm-cloud-managed \
         --payload-version=4.15.10
      cp /tmp/output/manifests/* /work
      cp /tmp/manifests/* /work
    command:
    - /bin/bash
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5007f7d6a2118a509aa64b30981ed0c7facc586e3fa80d731303cab68f210ba6
    imagePullPolicy: IfNotPresent
    name: init-bootstrap
    resources:
      requests:
        cpu: 30m
        memory: 50Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1002400000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /work
      name: bootstrap-manifests
  - args:
    - -c
    - |
      #!/bin/sh
      while ! nslookup etcd-client.ocm-staging-2begj3rejmrhokojq2e8c89tbbs1teit-perf-dry-0036.svc; do sleep 1; done
    command:
    - /bin/bash
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:879c6a69fc3c221dd4e01685bf90c1e5a85fab683b308e2a4ea97302f3c42c4e
    imagePullPolicy: IfNotPresent
    name: wait-for-etcd
    resources: {}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1002400000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
  nodeName: ip-10-0-127-161.us-east-2.compute.internal
  preemptionPolicy: Never
  priority: 100001000
  priorityClassName: hypershift-api-critical
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1002400000
    seLinuxOptions:
      level: s0:c49,c24
    seccompProfile:
      type: RuntimeDefault
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 95
  tolerations:
  - effect: NoSchedule
    key: hypershift.openshift.io/control-plane
    operator: Equal
    value: "true"
  - effect: NoSchedule
    key: hypershift.openshift.io/cluster
    operator: Equal
    value: ocm-staging-2begj3rejmrhokojq2e8c89tbbs1teit-perf-dry-0036
  - effect: NoSchedule
    key: hypershift.openshift.io/request-serving-component
    operator: Equal
    value: "true"
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  - effect: NoSchedule
    key: node.kubernetes.io/memory-pressure
    operator: Exists
  volumes:
  - emptyDir: {}
    name: bootstrap-manifests
  - name: localhost-kubeconfig
    secret:
      defaultMode: 416
      secretName: localhost-kubeconfig
  - emptyDir: {}
    name: logs
  - configMap:
      defaultMode: 420
      name: kas-config
    name: kas-config
  - configMap:
      defaultMode: 420
      name: auth-config
    name: auth-config
  - configMap:
      defaultMode: 420
      name: kas-audit-config
    name: audit-config
  - configMap:
      defaultMode: 416
      name: konnectivity-ca-bundle
    name: konnectivity-ca
  - name: server-crt
    secret:
      defaultMode: 416
      secretName: kas-server-crt
  - name: aggregator-crt
    secret:
      defaultMode: 416
      secretName: kas-aggregator-crt
  - configMap:
      defaultMode: 420
      name: aggregator-client-ca
    name: aggregator-ca
  - name: svcacct-key
    secret:
      defaultMode: 416
      secretName: sa-signing-key
  - configMap:
      defaultMode: 420
      name: etcd-ca
    name: etcd-ca
  - name: etcd-client-crt
    secret:
      defaultMode: 416
      secretName: etcd-client-tls
  - configMap:
      defaultMode: 420
      name: oauth-metadata
    name: oauth-metadata
  - name: auth-token-webhook-config
    secret:
      defaultMode: 416
      secretName: kas-authentication-token-webhook-config
  - configMap:
      defaultMode: 420
      name: client-ca
    name: client-ca
  - name: kubelet-client-crt
    secret:
      defaultMode: 416
      secretName: kas-kubelet-client-crt
  - configMap:
      defaultMode: 420
      name: client-ca
    name: kubelet-client-ca
  - name: konnectivity-client
    secret:
      defaultMode: 416
      secretName: konnectivity-client
  - configMap:
      defaultMode: 420
      name: kas-egress-selector-config
    name: egress-selector-config
  - name: kubeconfig
    secret:
      defaultMode: 416
      secretName: localhost-kubeconfig
  - name: server-certs
    secret:
      defaultMode: 416
      secretName: konnectivity-server
  - name: cluster-certs
    secret:
      defaultMode: 416
      secretName: konnectivity-cluster
  - name: named-cert-1
    secret:
      defaultMode: 416
      secretName: cluster-api-cert
  - name: aws-pod-identity-webhook-serving-certs
    secret:
      defaultMode: 420
      secretName: aws-pod-identity-webhook-serving-cert
  - name: aws-pod-identity-webhook-kubeconfig
    secret:
      defaultMode: 420
      secretName: aws-pod-identity-webhook-kubeconfig
  - name: kas-audit-webhook
    secret:
      defaultMode: 420
      secretName: perf-dry-0036-audit-webhook-kubeconfig
  - name: kas-secret-encryption-config
    secret:
      defaultMode: 420
      secretName: kas-secret-encryption-config
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2024-05-23T14:58:33Z"
    message: 'containers with incomplete status: [init-bootstrap wait-for-etcd]'
    reason: ContainersNotInitialized
    status: "False"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2024-05-23T14:58:33Z"
    reason: PodFailed
    status: "False"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2024-05-23T14:58:33Z"
    reason: PodFailed
    status: "False"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2024-05-23T14:58:33Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:879c6a69fc3c221dd4e01685bf90c1e5a85fab683b308e2a4ea97302f3c42c4e
    imageID: ""
    lastState: {}
    name: apply-bootstrap
    ready: false
    restartCount: 0
    started: false
    state:
      waiting:
        reason: PodInitializing
  - image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:879c6a69fc3c221dd4e01685bf90c1e5a85fab683b308e2a4ea97302f3c42c4e
    imageID: ""
    lastState: {}
    name: audit-logs
    ready: false
    restartCount: 0
    started: false
    state:
      waiting:
        reason: PodInitializing
  - image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3a42c0b392de386e32a5d3ef2055c3ed48bd2bc8ee653f4f89b7c288571e49bc
    imageID: ""
    lastState: {}
    name: aws-pod-identity-webhook
    ready: false
    restartCount: 0
    started: false
    state:
      waiting:
        reason: PodInitializing
  - image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:ab4810118ddc7ed3e25fd6535579a6c895c71eefe1dae6f2c8c48086af084f96
    imageID: ""
    lastState: {}
    name: konnectivity-server
    ready: false
    restartCount: 0
    started: false
    state:
      waiting:
        reason: PodInitializing
  - image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:713ad26ca7e13952cbb0c4815eef1fc49f4738cd09e2ca961545ee377d7226fe
    imageID: ""
    lastState: {}
    name: kube-apiserver
    ready: false
    restartCount: 0
    started: false
    state:
      waiting:
        reason: PodInitializing
  hostIP: 10.0.127.161
  initContainerStatuses:
  - image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:5007f7d6a2118a509aa64b30981ed0c7facc586e3fa80d731303cab68f210ba6
    imageID: ""
    lastState: {}
    name: init-bootstrap
    ready: false
    restartCount: 0
    state:
      terminated:
        exitCode: 137
        finishedAt: null
        message: The container could not be located when the pod was terminated
        reason: ContainerStatusUnknown
        startedAt: null
  - image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:879c6a69fc3c221dd4e01685bf90c1e5a85fab683b308e2a4ea97302f3c42c4e
    imageID: ""
    lastState: {}
    name: wait-for-etcd
    ready: false
    restartCount: 0
    state:
      waiting:
        reason: PodInitializing
  message: 'Pod was rejected: Predicate NodeAffinity failed'
  phase: Failed
  qosClass: Burstable
  reason: NodeAffinity
  startTime: "2024-05-23T14:58:33Z"
