apiVersion: v1
items:
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    creationTimestamp: "2024-10-30T03:58:44Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 1
    labels:
      open-cluster-management.io/addon-name: application-manager
    name: addon-application-manager-deploy-0
    namespace: vm02980
    ownerReferences:
    - apiVersion: addon.open-cluster-management.io/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedClusterAddOn
      name: application-manager
      uid: 57ffe39f-f21d-455c-af12-0463717c3271
    resourceVersion: "6034416"
    uid: b4de577b-502a-4360-b5ef-10042b4cecfc
  spec:
    workload:
      manifests:
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.14.0
            helm.sh/resource-policy: keep
          name: subscriptions.apps.open-cluster-management.io
        spec:
          group: apps.open-cluster-management.io
          names:
            kind: Subscription
            listKind: SubscriptionList
            plural: subscriptions
            shortNames:
            - appsub
            singular: subscription
          scope: Namespaced
          versions:
          - additionalPrinterColumns:
            - description: subscription state
              jsonPath: .status.phase
              name: SubscriptionState
              type: string
            - description: subscription status reference
              jsonPath: .status.appstatusReference
              name: AppstatusReference
              type: string
            - jsonPath: .metadata.creationTimestamp
              name: Age
              type: date
            - jsonPath: .status.lastUpdateTime
              name: Updated
              type: date
            - jsonPath: .spec.placement.local
              name: Local placement
              type: boolean
            - jsonPath: .spec.timewindow.windowtype
              name: Time window
              type: string
            name: v1
            schema:
              openAPIV3Schema:
                description: Subscription is the Schema for the subscriptions API
                properties:
                  apiVersion:
                    description: |-
                      APIVersion defines the versioned schema of this representation of an object.
                      Servers should convert recognized schemas to the latest internal value, and
                      may reject unrecognized values.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                    type: string
                  kind:
                    description: |-
                      Kind is a string value representing the REST resource this object represents.
                      Servers may infer this from the endpoint the client submits requests to.
                      Cannot be updated.
                      In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                    type: string
                  metadata:
                    type: object
                  spec:
                    description: SubscriptionSpec defines the desired state of Subscription
                    properties:
                      allow:
                        description: Specify a list of resources allowed for deployment
                        items:
                          description: AllowDenyItem defines a group of resources
                            allowed or denied for deployment
                          properties:
                            apiVersion:
                              description: APIVersion specifies the API version for
                                the group of resources
                              type: string
                            kinds:
                              description: Kinds specifies a list of kinds under the
                                same API version for the group of resources
                              items:
                                type: string
                              type: array
                          type: object
                        type: array
                      channel:
                        description: The primary channel namespaced name used by the
                          subscription. Its format is "<channel NameSpace>/<channel
                          Name>"
                        type: string
                      deny:
                        description: Specify a list of resources denied for deployment
                        items:
                          description: AllowDenyItem defines a group of resources
                            allowed or denied for deployment
                          properties:
                            apiVersion:
                              description: APIVersion specifies the API version for
                                the group of resources
                              type: string
                            kinds:
                              description: Kinds specifies a list of kinds under the
                                same API version for the group of resources
                              items:
                                type: string
                              type: array
                          type: object
                        type: array
                      hooksecretref:
                        description: Specify a secret reference used in Ansible job
                          integration authentication
                        properties:
                          apiVersion:
                            description: API version of the referent.
                            type: string
                          fieldPath:
                            description: |-
                              If referring to a piece of an object instead of an entire object, this string
                              should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
                              For example, if the object reference is to a container within a pod, this would take on a value like:
                              "spec.containers{name}" (where "name" refers to the name of the container that triggered
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
                              Kind of the referent.
                              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                            type: string
                          name:
                            description: |-
                              Name of the referent.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                          namespace:
                            description: |-
                              Namespace of the referent.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
                            type: string
                          resourceVersion:
                            description: |-
                              Specific resourceVersion to which this reference is made, if any.
                              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
                            type: string
                          uid:
                            description: |-
                              UID of the referent.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
                            type: string
                        type: object
                        x-kubernetes-map-type: atomic
                      name:
                        description: Subscribe a package by its package name
                        type: string
                      overrides:
                        description: Specify overrides when applied to clusters. Hub
                          use only
                        items:
                          description: ClusterOverrides defines a list of contents
                            that will be overridden to a given cluster
                          properties:
                            clusterName:
                              description: Cluster name
                              type: string
                            clusterOverrides:
                              description: ClusterOverrides defines a list of content
                                for override
                              items:
                                description: ClusterOverride defines the contents
                                  for override rules
                                type: object
                                x-kubernetes-preserve-unknown-fields: true
                              minItems: 1
                              type: array
                          required:
                          - clusterName
                          - clusterOverrides
                          type: object
                        type: array
                      packageFilter:
                        description: Subscribe packages by a package filter
                        properties:
                          annotations:
                            additionalProperties:
                              type: string
                            description: Annotations defines a type of filter for
                              selecting resources by annotations
                            type: object
                          filterRef:
                            description: FilterRef defines a type of filter for selecting
                              resources by another resource reference
                            properties:
                              name:
                                description: |-
                                  Name of the referent.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                  TODO: Add other useful fields. apiVersion, kind, uid?
                                type: string
                            type: object
                            x-kubernetes-map-type: atomic
                          labelSelector:
                            description: LabelSelector defines a type of filter for
                              selecting resources by label selector
                            properties:
                              matchExpressions:
                                description: matchExpressions is a list of label selector
                                  requirements. The requirements are ANDed.
                                items:
                                  description: |-
                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                    relates the key and values.
                                  properties:
                                    key:
                                      description: key is the label key that the selector
                                        applies to.
                                      type: string
                                    operator:
                                      description: |-
                                        operator represents a key's relationship to a set of values.
                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                      type: string
                                    values:
                                      description: |-
                                        values is an array of string values. If the operator is In or NotIn,
                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty. This array is replaced during a strategic
                                        merge patch.
                                      items:
                                        type: string
                                      type: array
                                  required:
                                  - key
                                  - operator
                                  type: object
                                type: array
                              matchLabels:
                                additionalProperties:
                                  type: string
                                description: |-
                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                type: object
                            type: object
                            x-kubernetes-map-type: atomic
                          version:
                            description: Version defines a type of filter for selecting
                              resources by version
                            type: string
                        type: object
                      packageOverrides:
                        description: Override packages
                        items:
                          description: Overrides defines a list of contents that will
                            be overridden to a given resource
                          properties:
                            packageAlias:
                              description: PackageAlias defines the alias of the package
                                name that will be onverriden
                              type: string
                            packageName:
                              description: PackageName defines the package name that
                                will be onverriden
                              type: string
                            packageOverrides:
                              description: PackageOverrides defines a list of content
                                for override
                              items:
                                description: PackageOverride provides the contents
                                  for overriding a package
                                type: object
                                x-kubernetes-preserve-unknown-fields: true
                              type: array
                          required:
                          - packageName
                          type: object
                        type: array
                      placement:
                        description: Specify a placement reference for selecting clusters.
                          Hub use only
                        properties:
                          clusterSelector:
                            description: |-
                              A label selector is a label query over a set of resources. The result of matchLabels and
                              matchExpressions are ANDed. An empty label selector matches all objects. A null
                              label selector matches no objects.
                            properties:
                              matchExpressions:
                                description: matchExpressions is a list of label selector
                                  requirements. The requirements are ANDed.
                                items:
                                  description: |-
                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                    relates the key and values.
                                  properties:
                                    key:
                                      description: key is the label key that the selector
                                        applies to.
                                      type: string
                                    operator:
                                      description: |-
                                        operator represents a key's relationship to a set of values.
                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                      type: string
                                    values:
                                      description: |-
                                        values is an array of string values. If the operator is In or NotIn,
                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty. This array is replaced during a strategic
                                        merge patch.
                                      items:
                                        type: string
                                      type: array
                                  required:
                                  - key
                                  - operator
                                  type: object
                                type: array
                              matchLabels:
                                additionalProperties:
                                  type: string
                                description: |-
                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                type: object
                            type: object
                            x-kubernetes-map-type: atomic
                          clusters:
                            items:
                              description: GenericClusterReference - in alignment
                                with kubefed
                              properties:
                                name:
                                  type: string
                              required:
                              - name
                              type: object
                            type: array
                          local:
                            description: It indicates a standalone subscription if
                              the Local pointer is set to be true
                            type: boolean
                          placementRef:
                            description: Specify a placement reference for selecting
                              clusters
                            properties:
                              apiVersion:
                                description: API version of the referent.
                                type: string
                              fieldPath:
                                description: |-
                                  If referring to a piece of an object instead of an entire object, this string
                                  should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
                                  For example, if the object reference is to a container within a pod, this would take on a value like:
                                  "spec.containers{name}" (where "name" refers to the name of the container that triggered
                                  the event) or if no container name is specified "spec.containers[2]" (container with
                                  index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                  referencing a part of an object.
                                  TODO: this design is not final and this field is subject to change in the future.
                                type: string
                              kind:
                                description: |-
                                  Kind of the referent.
                                  More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                                type: string
                              name:
                                description: |-
                                  Name of the referent.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                              namespace:
                                description: |-
                                  Namespace of the referent.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
                                type: string
                              resourceVersion:
                                description: |-
                                  Specific resourceVersion to which this reference is made, if any.
                                  More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
                                type: string
                              uid:
                                description: |-
                                  UID of the referent.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
                                type: string
                            type: object
                            x-kubernetes-map-type: atomic
                        type: object
                      secondaryChannel:
                        description: The secondary channel will be applied if the
                          primary channel fails to connect
                        type: string
                      timewindow:
                        description: Specify a time window to indicate when the subscription
                          is handled
                        properties:
                          daysofweek:
                            description: 'A list of days of a week, valid values include:
                              Sunday, Monday, Tuesday, Wednesday, Thursday, Friday,
                              Saturday'
                            items:
                              type: string
                            type: array
                          hours:
                            description: A list of hour ranges
                            items:
                              description: HourRange defines the time format, refer
                                to https://golang.org/pkg/time/#pkg-constants
                              properties:
                                end:
                                  description: End time of the hour range
                                  type: string
                                start:
                                  description: Start time of the hour range
                                  type: string
                              type: object
                            type: array
                          location:
                            description: time zone location, refer to TZ identifier
                              in https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
                            type: string
                          windowtype:
                            description: |-
                              Activiate time window or not. The subscription deployment will only be handled during these active windows
                              Valid values include: active,blocked,Active,Blocked
                            enum:
                            - active
                            - blocked
                            - Active
                            - Blocked
                            type: string
                        type: object
                      watchHelmNamespaceScopedResources:
                        description: WatchHelmNamespaceScopedResources is used to
                          enable watching namespace scope Helm chart resources
                        type: boolean
                    required:
                    - channel
                    type: object
                  status:
                    description: SubscriptionStatus defines the observed status of
                      a subscription
                    properties:
                      ansiblejobs:
                        description: AnsibleJobsStatus defines status of ansible jobs
                          propagated by the subscription
                        properties:
                          lastposthookjob:
                            description: The lastly propagated posthook job
                            type: string
                          lastprehookjob:
                            description: The lastly propagated prehook job
                            type: string
                          posthookjobshistory:
                            description: reserved for backward compatibility
                            items:
                              type: string
                            type: array
                          prehookjobshistory:
                            description: reserved for backward compatibility
                            items:
                              type: string
                            type: array
                        type: object
                      appstatusReference:
                        description: The CLI reference for getting the subscription
                          status output
                        type: string
                      lastUpdateTime:
                        description: Timestamp of when the subscription status was
                          last updated.
                        format: date-time
                        type: string
                      message:
                        description: Informational message of the subscription deployment
                        type: string
                      phase:
                        description: Phase of the subscription deployment
                        type: string
                      reason:
                        description: additional error output of the subscription deployment
                        type: string
                      statuses:
                        additionalProperties:
                          description: SubscriptionPerClusterStatus defines status
                            of each subscription in a cluster, key is package name
                          properties:
                            packages:
                              additionalProperties:
                                description: SubscriptionUnitStatus defines status
                                  of each package in a subscription
                                properties:
                                  lastUpdateTime:
                                    description: Timestamp of when the deployment
                                      package was last updated.
                                    format: date-time
                                    type: string
                                  message:
                                    description: Informational message from the deployment
                                      of the package.
                                    type: string
                                  phase:
                                    description: Phase of the deployment package (Propagated/Subscribed/Failed/PropagationFailed/PreHookSucessful).
                                    type: string
                                  reason:
                                    description: additional error output from the
                                      deployment of the package.
                                    type: string
                                  resourceStatus:
                                    description: reserved for backward compatibility
                                    type: object
                                    x-kubernetes-preserve-unknown-fields: true
                                required:
                                - lastUpdateTime
                                type: object
                              type: object
                          type: object
                        description: SubscriptionClusterStatusMap defines status of
                          each subscription per cluster, key is cluster name
                        type: object
                    type: object
                required:
                - spec
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
          conditions: null
          storedVersions: null
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.4.0
            helm.sh/resource-policy: keep
          name: helmreleases.apps.open-cluster-management.io
        spec:
          group: apps.open-cluster-management.io
          names:
            kind: HelmRelease
            listKind: HelmReleaseList
            plural: helmreleases
            singular: helmrelease
          scope: Namespaced
          versions:
          - name: v1
            schema:
              openAPIV3Schema:
                description: HelmRelease is the Schema for the subscriptionreleases
                  API
                properties:
                  apiVersion:
                    description: 'APIVersion defines the versioned schema of this
                      representation of an object. Servers should convert recognized
                      schemas to the latest internal value, and may reject unrecognized
                      values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                    type: string
                  kind:
                    description: 'Kind is a string value representing the REST resource
                      this object represents. Servers may infer this from the endpoint
                      the client submits requests to. Cannot be updated. In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                    type: string
                  metadata:
                    type: object
                  repo:
                    description: HelmReleaseRepo defines the repository of HelmRelease
                    properties:
                      altSource:
                        description: AltSource holds the url toward the Helm chart
                        properties:
                          configMapRef:
                            description: Configuration parameters to access the helm-repo
                              defined in the CatalogSource
                            properties:
                              apiVersion:
                                description: API version of the referent.
                                type: string
                              fieldPath:
                                description: 'If referring to a piece of an object
                                  instead of an entire object, this string should
                                  contain a valid JSON/Go field access statement,
                                  such as desiredState.manifest.containers[2]. For
                                  example, if the object reference is to a container
                                  within a pod, this would take on a value like: "spec.containers{name}"
                                  (where "name" refers to the name of the container
                                  that triggered the event) or if no container name
                                  is specified "spec.containers[2]" (container with
                                  index 2 in this pod). This syntax is chosen only
                                  to have some well-defined way of referencing a part
                                  of an object. TODO: this design is not final and
                                  this field is subject to change in the future.'
                                type: string
                              kind:
                                description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                                type: string
                              name:
                                description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                type: string
                              namespace:
                                description: 'Namespace of the referent. More info:
                                  https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                type: string
                              resourceVersion:
                                description: 'Specific resourceVersion to which this
                                  reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
                                type: string
                              uid:
                                description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
                                type: string
                            type: object
                          git:
                            description: Git provides the parameters to access the
                              Helm chart located in a git repo
                            properties:
                              branch:
                                type: string
                              chartPath:
                                type: string
                              urls:
                                items:
                                  type: string
                                type: array
                            type: object
                          github:
                            description: GitHub provides the parameters to access
                              the Helm chart located in a github repo
                            properties:
                              branch:
                                type: string
                              chartPath:
                                type: string
                              urls:
                                items:
                                  type: string
                                type: array
                            type: object
                          helmRepo:
                            description: HelmRepo provides the urls to retrieve the
                              Helm chart
                            properties:
                              urls:
                                items:
                                  type: string
                                type: array
                            type: object
                          insecureSkipVerify:
                            description: InsecureSkipVerify is used to skip repo server's
                              TLS certificate verification
                            type: boolean
                          secretRef:
                            description: Secret to use to access the helm-repo defined
                              in the CatalogSource.
                            properties:
                              apiVersion:
                                description: API version of the referent.
                                type: string
                              fieldPath:
                                description: 'If referring to a piece of an object
                                  instead of an entire object, this string should
                                  contain a valid JSON/Go field access statement,
                                  such as desiredState.manifest.containers[2]. For
                                  example, if the object reference is to a container
                                  within a pod, this would take on a value like: "spec.containers{name}"
                                  (where "name" refers to the name of the container
                                  that triggered the event) or if no container name
                                  is specified "spec.containers[2]" (container with
                                  index 2 in this pod). This syntax is chosen only
                                  to have some well-defined way of referencing a part
                                  of an object. TODO: this design is not final and
                                  this field is subject to change in the future.'
                                type: string
                              kind:
                                description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                                type: string
                              name:
                                description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                type: string
                              namespace:
                                description: 'Namespace of the referent. More info:
                                  https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                type: string
                              resourceVersion:
                                description: 'Specific resourceVersion to which this
                                  reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
                                type: string
                              uid:
                                description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
                                type: string
                            type: object
                          type:
                            description: SourceTypeEnum types of sources
                            type: string
                        type: object
                      chartName:
                        description: ChartName is the name of the chart within the
                          repo
                        type: string
                      configMapRef:
                        description: Configuration parameters to access the helm-repo
                          defined in the CatalogSource
                        properties:
                          apiVersion:
                            description: API version of the referent.
                            type: string
                          fieldPath:
                            description: 'If referring to a piece of an object instead
                              of an entire object, this string should contain a valid
                              JSON/Go field access statement, such as desiredState.manifest.containers[2].
                              For example, if the object reference is to a container
                              within a pod, this would take on a value like: "spec.containers{name}"
                              (where "name" refers to the name of the container that
                              triggered the event) or if no container name is specified
                              "spec.containers[2]" (container with index 2 in this
                              pod). This syntax is chosen only to have some well-defined
                              way of referencing a part of an object. TODO: this design
                              is not final and this field is subject to change in
                              the future.'
                            type: string
                          kind:
                            description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                            type: string
                          name:
                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                            type: string
                          namespace:
                            description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                            type: string
                          resourceVersion:
                            description: 'Specific resourceVersion to which this reference
                              is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
                            type: string
                          uid:
                            description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
                            type: string
                        type: object
                      digest:
                        description: Digest is the helm repo chart digest
                        type: string
                      insecureSkipVerify:
                        description: InsecureSkipVerify is used to skip repo server's
                          TLS certificate verification
                        type: boolean
                      secretRef:
                        description: Secret to use to access the helm-repo defined
                          in the CatalogSource.
                        properties:
                          apiVersion:
                            description: API version of the referent.
                            type: string
                          fieldPath:
                            description: 'If referring to a piece of an object instead
                              of an entire object, this string should contain a valid
                              JSON/Go field access statement, such as desiredState.manifest.containers[2].
                              For example, if the object reference is to a container
                              within a pod, this would take on a value like: "spec.containers{name}"
                              (where "name" refers to the name of the container that
                              triggered the event) or if no container name is specified
                              "spec.containers[2]" (container with index 2 in this
                              pod). This syntax is chosen only to have some well-defined
                              way of referencing a part of an object. TODO: this design
                              is not final and this field is subject to change in
                              the future.'
                            type: string
                          kind:
                            description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                            type: string
                          name:
                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                            type: string
                          namespace:
                            description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                            type: string
                          resourceVersion:
                            description: 'Specific resourceVersion to which this reference
                              is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
                            type: string
                          uid:
                            description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
                            type: string
                        type: object
                      source:
                        description: Source holds the url toward the Helm chart
                        properties:
                          git:
                            description: Git provides the parameters to access the
                              Helm chart located in a git repo
                            properties:
                              branch:
                                type: string
                              chartPath:
                                type: string
                              urls:
                                items:
                                  type: string
                                type: array
                            type: object
                          github:
                            description: GitHub provides the parameters to access
                              the Helm chart located in a github repo
                            properties:
                              branch:
                                type: string
                              chartPath:
                                type: string
                              urls:
                                items:
                                  type: string
                                type: array
                            type: object
                          helmRepo:
                            description: HelmRepo provides the urls to retrieve the
                              Helm chart
                            properties:
                              urls:
                                items:
                                  type: string
                                type: array
                            type: object
                          type:
                            description: SourceTypeEnum types of sources
                            type: string
                        type: object
                      version:
                        description: Version is the chart version
                        type: string
                      watchNamespaceScopedResources:
                        description: WatchNamespaceScopedResources is used to enable
                          watching namespace scope Helm chart resources
                        type: boolean
                    type: object
                  spec:
                    x-kubernetes-preserve-unknown-fields: true
                  status:
                    properties:
                      conditions:
                        items:
                          properties:
                            lastTransitionTime:
                              format: date-time
                              type: string
                            message:
                              type: string
                            reason:
                              type: string
                            status:
                              type: string
                            type:
                              type: string
                          required:
                          - status
                          - type
                          type: object
                        type: array
                      deployedRelease:
                        properties:
                          manifest:
                            type: string
                          name:
                            type: string
                        type: object
                    required:
                    - conditions
                    type: object
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
          conditions: []
          storedVersions: []
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.14.0
            helm.sh/resource-policy: keep
          name: subscriptionstatuses.apps.open-cluster-management.io
        spec:
          group: apps.open-cluster-management.io
          names:
            kind: SubscriptionStatus
            listKind: SubscriptionStatusList
            plural: subscriptionstatuses
            shortNames:
            - appsubstatus
            singular: subscriptionstatus
          scope: Namespaced
          versions:
          - name: v1alpha1
            schema:
              openAPIV3Schema:
                description: SubscriptionStatus provides detailed status for all the
                  resources that are deployed by the application in a cluster.
                properties:
                  apiVersion:
                    description: |-
                      APIVersion defines the versioned schema of this representation of an object.
                      Servers should convert recognized schemas to the latest internal value, and
                      may reject unrecognized values.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                    type: string
                  kind:
                    description: |-
                      Kind is a string value representing the REST resource this object represents.
                      Servers may infer this from the endpoint the client submits requests to.
                      Cannot be updated.
                      In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                    type: string
                  metadata:
                    type: object
                  statuses:
                    description: SubscriptionClusterStatusMap contains the status
                      of deployment packages in a cluster.
                    properties:
                      packages:
                        items:
                          description: SubscriptionUnitStatus provides the status
                            of a single deployment package.
                          properties:
                            apiVersion:
                              description: API version of the deployment package.
                              type: string
                            kind:
                              description: Kind of the deployment package.
                              type: string
                            lastUpdateTime:
                              description: Timestamp of when the deployment package
                                was last updated.
                              format: date-time
                              type: string
                            message:
                              description: Informational message or error output from
                                the deployment of the package.
                              type: string
                            name:
                              description: Name of the deployment package.
                              type: string
                            namespace:
                              description: Namespace where the deployment package
                                is deployed.
                              type: string
                            phase:
                              description: Phase of the deployment package (unknown/deployed/failed/propagationFailed).
                              type: string
                          required:
                          - lastUpdateTime
                          type: object
                        type: array
                      subscription:
                        description: |-
                          SubscriptionOverallStatus provides the overall status of the subscription. It is computed using the status of
                          all the deployment packages in the subscription.
                        properties:
                          lastUpdateTime:
                            description: Timestamp of when the overall subscription
                              status was last updated.
                            format: date-time
                            type: string
                          message:
                            description: Informational message or error output from
                              the overall subscription status.
                            type: string
                          phase:
                            description: Phase of the overall subscription status
                              (unknown/deployed/failed).
                            type: string
                        type: object
                    type: object
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
          conditions: null
          storedVersions: null
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          labels:
            component: application-manager
          name: application-manager
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          revisionHistoryLimit: 2
          selector:
            matchLabels:
              component: application-manager
          strategy: {}
          template:
            metadata:
              annotations:
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              creationTimestamp: null
              labels:
                component: application-manager
            spec:
              containers:
              - args:
                - --alsologtostderr
                - --cluster-name=vm02980
                - --hub-cluster-configfile=/var/run/klusterlet/kubeconfig
                - --leader-election-lease-duration=137s
                - --leader-election-renew-deadline=107s
                - --leader-election-retry-period=26s
                command:
                - /usr/local/bin/multicluster-operators-subscription
                env:
                - name: WATCH_NAMESPACE
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      apiVersion: v1
                      fieldPath: metadata.name
                - name: OPERATOR_NAME
                  value: subscription-controller
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/multicluster-operators-subscription-rhel9@sha256:c56c7d7cd43726cc87adc26ca950b766a7db0e615e5225d08519e364d62a04f4
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  httpGet:
                    path: /healthz
                    port: 8000
                  initialDelaySeconds: 2
                  periodSeconds: 10
                name: subscription-controller
                readinessProbe:
                  exec:
                    command:
                    - ls
                  initialDelaySeconds: 15
                  periodSeconds: 15
                resources:
                  limits:
                    memory: 2Gi
                  requests:
                    memory: 128Mi
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                  runAsNonRoot: true
                  runAsUser: 1000
                volumeMounts:
                - mountPath: /var/run/klusterlet
                  name: klusterlet-config
                - mountPath: /tmp
                  name: tmp
              imagePullSecrets:
              - name: open-cluster-management-image-pull-credentials
              securityContext:
                seccompProfile:
                  type: RuntimeDefault
              serviceAccountName: application-manager
              tolerations:
              - effect: NoSchedule
                key: dedicated
                operator: Equal
                value: infra
              - effect: NoSchedule
                key: node-role.kubernetes.io/infra
                operator: Exists
              volumes:
              - name: klusterlet-config
                secret:
                  secretName: application-manager-hub-kubeconfig
              - emptyDir: {}
                name: tmp
        status: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            component: application-manager
          name: open-cluster-management:application-manager
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:application-manager
        subjects:
        - kind: ServiceAccount
          name: application-manager
          namespace: open-cluster-management-agent-addon
      - apiVersion: v1
        kind: Service
        metadata:
          labels:
            app: mc-subscription-metrics
          name: mc-subscription-metrics
          namespace: open-cluster-management-agent-addon
        spec:
          ports:
          - name: metrics
            port: 8388
            protocol: TCP
            targetPort: 8388
          selector:
            component: application-manager
          sessionAffinity: None
          type: ClusterIP
        status:
          loadBalancer: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            rbac.authorization.k8s.io/aggregate-to-admin: "true"
          name: aggregate-appsub-admin
        rules:
        - apiGroups:
          - apps.open-cluster-management.io
          resources:
          - subscriptions
          verbs:
          - '*'
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            component: application-manager
          name: open-cluster-management:application-manager
        rules:
        - apiGroups:
          - '*'
          resources:
          - '*'
          verbs:
          - '*'
        - nonResourceURLs:
          - '*'
          verbs:
          - '*'
      - apiVersion: v1
        kind: ServiceAccount
        metadata:
          labels:
            component: application-manager
          name: application-manager
          namespace: open-cluster-management-agent-addon
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:47Z"
      message: Apply manifest work complete
      observedGeneration: 1
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:48Z"
      message: All resources are available
      observedGeneration: 1
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: subscriptions.apps.open-cluster-management.io
          namespace: ""
          ordinal: 0
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: helmreleases.apps.open-cluster-management.io
          namespace: ""
          ordinal: 1
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: subscriptionstatuses.apps.open-cluster-management.io
          namespace: ""
          ordinal: 2
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: application-manager
          namespace: open-cluster-management-agent-addon
          ordinal: 3
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:application-manager
          namespace: ""
          ordinal: 4
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Service
          name: mc-subscription-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 5
          resource: services
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: aggregate-appsub-admin
          namespace: ""
          ordinal: 6
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:application-manager
          namespace: ""
          ordinal: 7
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:48Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:48Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: application-manager
          namespace: open-cluster-management-agent-addon
          ordinal: 8
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    creationTimestamp: "2024-10-30T03:58:42Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 1
    labels:
      open-cluster-management.io/addon-name: cert-policy-controller
    name: addon-cert-policy-controller-deploy-0
    namespace: vm02980
    ownerReferences:
    - apiVersion: addon.open-cluster-management.io/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedClusterAddOn
      name: cert-policy-controller
      uid: 73a10f26-ea79-4988-821a-e276a4de6077
    resourceVersion: "6033510"
    uid: e9699954-6f6c-4a07-9226-4f3347412c35
  spec:
    workload:
      manifests:
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.16.3
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            policy.open-cluster-management.io/policy-type: template
          name: certificatepolicies.policy.open-cluster-management.io
        spec:
          group: policy.open-cluster-management.io
          names:
            kind: CertificatePolicy
            listKind: CertificatePolicyList
            plural: certificatepolicies
            singular: certificatepolicy
          scope: Namespaced
          versions:
          - name: v1
            schema:
              openAPIV3Schema:
                description: CertificatePolicy is the schema for the certificatepolicies
                  API. Certificate policy monitors certificates on a cluster against
                  user-defined restrictions, and it returns a noncompliance status
                  if any certificate does not meet the requirements of the parameters.
                  By default the certificate policy uses the 'tls.crt' key of a secret
                  to find the certificate, but you can use an alternate key if specified
                  in the 'certificate_key_name' label on the secret.
                properties:
                  apiVersion:
                    description: 'APIVersion defines the versioned schema of this
                      representation of an object. Servers should convert recognized
                      schemas to the latest internal value, and may reject unrecognized
                      values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                    type: string
                  kind:
                    description: 'Kind is a string value representing the REST resource
                      this object represents. Servers may infer this from the endpoint
                      the client submits requests to. Cannot be updated. In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                    type: string
                  metadata:
                    type: object
                  spec:
                    description: CertificatePolicySpec defines which certificates
                      need to be checked and how those certificates should be configured
                      to be compliant with the policy. Enforce remediation action
                      is not currently supported, so you are responsible to take actions
                      to fix any noncompliant certificates.
                    properties:
                      allowedSANPattern:
                        description: AllowedSANPattern is the pattern that must match
                          any defined subject alternative name (SAN) entries in the
                          certificate for the certificate to be compliant. Refer to
                          https://pkg.go.dev/regexp/syntax for the regular expression
                          syntax.
                        minLength: 1
                        type: string
                      disallowedSANPattern:
                        description: DisallowedSANPattern is the pattern that must
                          not match any defined subject alternative name (SAN) entries
                          in the certificate for the certificate to be compliant.
                          Refer to https://pkg.go.dev/regexp/syntax for the regular
                          expression syntax.
                        minLength: 1
                        type: string
                      labelSelector:
                        additionalProperties:
                          minLength: 1
                          type: string
                        description: LabelSelector restricts the secrets that are
                          checked to the ones that match these labels.
                        type: object
                      maximumCADuration:
                        description: MaxCADuration is the maximum duration for the
                          expiration of the certificate authority (CA), where a value
                          that is greater than that duration is considered noncompliant.
                          The value follows the Golang duration format 0h0m0s, where
                          hours (h) is the largest accepted unit of time.
                        pattern: ^(?:(?:[0-9]+(?:.[0-9])?)(?:h|m|s|(?:ms)|(?:us)|(?:ns)))+$
                        type: string
                      maximumDuration:
                        description: MaxDuration is the maximum duration for the expiration
                          of a certificate, where a value that is greater than that
                          duration is considered noncompliant. The value follows the
                          Golang duration format 0h0m0s, where hours (h) is the largest
                          accepted unit of time.
                        pattern: ^(?:(?:[0-9]+(?:.[0-9])?)(?:h|m|s|(?:ms)|(?:us)|(?:ns)))+$
                        type: string
                      minimumCADuration:
                        description: MinCADuration is the minimum duration for the
                          expiration of the certificate authority (CA), where any
                          value lesser than that duration is considered noncompliant.
                          The value follows the Golang duration format 0h0m0s, where
                          hours (h) is the largest accepted unit of time.
                        pattern: ^(?:(?:[0-9]+(?:.[0-9])?)(?:h|m|s|(?:ms)|(?:us)|(?:ns)))+$
                        type: string
                      minimumDuration:
                        description: MinDuration is the minimum duration for the expiration
                          of a certificate, where a value that is lesser than that
                          duration is considered noncompliant. The value follows the
                          Golang duration format 0h0m0s, where hours (h) is the largest
                          accepted unit of time.
                        pattern: ^(?:(?:[0-9]+(?:.[0-9])?)(?:h|m|s|(?:ms)|(?:us)|(?:ns)))+$
                        type: string
                      namespaceSelector:
                        description: NamespaceSelector determines namespaces on the
                          managed cluster in which to validate certificates. The Include
                          and Exclude parameters accept file path expressions to include
                          and exclude namespaces by name. The MatchExpressions and
                          MatchLabels parameters specify namespaces to include by
                          label. See the Kubernetes labels and selectors documentation.
                          The resulting list is compiled by using the intersection
                          of results from all parameters. You must provide either
                          Include or at least one of MatchExpressions or MatchLabels
                          to retrieve namespaces.
                        properties:
                          exclude:
                            description: Exclude is an array of filepath expressions
                              to exclude objects by name.
                            items:
                              minLength: 1
                              type: string
                            type: array
                          include:
                            description: Include is an array of filepath expressions
                              to include objects by name.
                            items:
                              minLength: 1
                              type: string
                            type: array
                          matchExpressions:
                            description: MatchExpressions is an array of label selector
                              requirements matching objects by label.
                            items:
                              description: A label selector requirement is a selector
                                that contains values, a key, and an operator that
                                relates the key and values.
                              properties:
                                key:
                                  description: key is the label key that the selector
                                    applies to.
                                  type: string
                                operator:
                                  description: operator represents a key's relationship
                                    to a set of values. Valid operators are In, NotIn,
                                    Exists and DoesNotExist.
                                  type: string
                                values:
                                  description: values is an array of string values.
                                    If the operator is In or NotIn, the values array
                                    must be non-empty. If the operator is Exists or
                                    DoesNotExist, the values array must be empty.
                                    This array is replaced during a strategic merge
                                    patch.
                                  items:
                                    type: string
                                  type: array
                              required:
                              - key
                              - operator
                              type: object
                            type: array
                          matchLabels:
                            additionalProperties:
                              type: string
                            description: MatchLabels is a map of {key,value} pairs
                              matching objects by label.
                            type: object
                        type: object
                      remediationAction:
                        description: RemediationAction must be set to "Inform". Enforce
                          is not currently supported, so setting this to "Enforce"
                          has the same effect as "Inform".
                        enum:
                        - Inform
                        - inform
                        - Enforce
                        - enforce
                        type: string
                      severity:
                        description: Severity is a user-defined severity for when
                          a certificate is found out of compliance with this certificate
                          policy. Accepted values are low, medium, high, and critical.
                        enum:
                        - low
                        - Low
                        - medium
                        - Medium
                        - high
                        - High
                        - critical
                        - Critical
                        type: string
                    type: object
                  status:
                    description: CertificatePolicyStatus reports the observed status
                      that results from parameters of the certificate policy.
                    properties:
                      compliancyDetails:
                        additionalProperties:
                          description: CompliancyDetails reports the details related
                            to whether the policy is compliant.
                          properties:
                            message:
                              description: Message is a human-readable summary of
                                the compliance details.
                              type: string
                            nonCompliantCertificates:
                              description: NonCompliantCertificates reports the total
                                number of noncompliant certificates.
                              type: integer
                            nonCompliantCertificatesList:
                              additionalProperties:
                                description: Cert reports the related secret and parsed
                                  details of a certificate.
                                properties:
                                  ca:
                                    description: CA is a boolean reporting whether
                                      the certificate contains a CA.
                                    type: boolean
                                  duration:
                                    description: Duration is the total duration of
                                      the certificate by calculating the difference
                                      between its NotAfter and NotBefore values.
                                    format: int64
                                    type: integer
                                  expiration:
                                    description: Expiration is the string representation
                                      of the expiration date of the certificate in
                                      UTC RFC 3339 format.
                                    type: string
                                  expiry:
                                    description: Expiry is the time.Duration representation
                                      of the expiration of the certificate from the
                                      time of the report.
                                    format: int64
                                    type: integer
                                  sans:
                                    description: Sans is a list of subject alternative
                                      names in the certificate.
                                    items:
                                      type: string
                                    type: array
                                  secretName:
                                    description: Secret is the name of the secret
                                      containing the certificate.
                                    type: string
                                type: object
                              description: NonCompliantCertificatesList reports a
                                map of the details for each noncompliant certificate,
                                where the key comes from the "certificate-name" label,
                                "certmanager.k8s.io/certificate-name" label, or defaults
                                to the name of the secret.
                              type: object
                          type: object
                        description: CompliancyDetails is a map of namespaces to the
                          compliance details of its contained certificates.
                        type: object
                      compliant:
                        description: ComplianceState reports the compliance that results
                          from parameters of the certificate policy.
                        enum:
                        - Compliant
                        - NonCompliant
                        - UnknownCompliancy
                        type: string
                    type: object
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
          conditions: null
          storedVersions: null
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: cert-policy-controller
            chart: cert-policy-controller-2.2.0
            heritage: Helm
            release: cert-policy-controller
          name: cert-policy-controller
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          selector:
            matchLabels:
              app: cert-policy-controller
              release: cert-policy-controller
          strategy:
            type: Recreate
          template:
            metadata:
              annotations:
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              creationTimestamp: null
              labels:
                app: cert-policy-controller
                chart: cert-policy-controller-2.2.0
                heritage: Helm
                release: cert-policy-controller
            spec:
              affinity: {}
              containers:
              - args:
                - --enable-lease=true
                - --cluster-name=vm02980
                - --update-frequency=30
                - --leader-elect=false
                - --log-encoder=console
                - --log-level=0
                - --v=-1
                env:
                - name: WATCH_NAMESPACE
                  value: vm02980
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: OPERATOR_NAME
                  value: cert-policy-controller
                - name: HTTP_PROXY
                - name: HTTPS_PROXY
                - name: NO_PROXY
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/cert-policy-controller-rhel9@sha256:c10bd74b7da0c01db8bad4c4e7b129c9d4ca33d9c926fca6fe1157f5c28b1971
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /healthz
                    port: 8081
                  periodSeconds: 10
                name: cert-policy-controller
                readinessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /readyz
                    port: 8081
                  periodSeconds: 10
                resources:
                  limits:
                    memory: 300Mi
                  requests:
                    memory: 150Mi
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                startupProbe:
                  failureThreshold: 30
                  httpGet:
                    path: /readyz
                    port: 8081
                  periodSeconds: 10
                volumeMounts:
                - mountPath: /var/run/klusterlet
                  name: klusterlet-config
              imagePullSecrets:
              - name: open-cluster-management-image-pull-credentials
              securityContext:
                runAsNonRoot: true
              serviceAccount: cert-policy-controller-sa
              tolerations:
              - effect: NoSchedule
                key: dedicated
                operator: Exists
              - key: CriticalAddonsOnly
                operator: Exists
              - effect: NoSchedule
                key: node.kubernetes.io/not-ready
                operator: Exists
              - effect: NoSchedule
                key: node-role.kubernetes.io/infra
                operator: Exists
              volumes:
              - name: klusterlet-config
                secret:
                  secretName: cert-policy-controller-hub-kubeconfig
        status: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: cert-policy-controller
            chart: cert-policy-controller-2.2.0
            heritage: Helm
            release: cert-policy-controller
          name: open-cluster-management:cert-policy-controller
        rules:
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
          - patch
        - apiGroups:
          - ""
          resources:
          - namespaces
          verbs:
          - list
        - apiGroups:
          - ""
          resources:
          - secrets
          verbs:
          - get
          - list
        - apiGroups:
          - policy.open-cluster-management.io
          resources:
          - certificatepolicies
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - policy.open-cluster-management.io
          resources:
          - certificatepolicies/finalizers
          verbs:
          - update
        - apiGroups:
          - policy.open-cluster-management.io
          resources:
          - certificatepolicies/status
          verbs:
          - get
          - patch
          - update
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: cert-policy-controller
            chart: cert-policy-controller-2.2.0
            heritage: Helm
            release: cert-policy-controller
          name: cert-policy-controller-leader
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: cert-policy-controller-leader
        subjects:
        - kind: ServiceAccount
          name: cert-policy-controller-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: cert-policy-controller
            chart: cert-policy-controller-2.2.0
            heritage: Helm
            release: cert-policy-controller
          name: open-cluster-management:cert-policy-controller
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:cert-policy-controller
        subjects:
        - kind: ServiceAccount
          name: cert-policy-controller-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: cert-policy-controller
            chart: cert-policy-controller-2.2.0
            heritage: Helm
            release: cert-policy-controller
          name: cert-policy-controller-leader
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - get
          - list
          - watch
          - create
          - update
          - patch
          - delete
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
          - patch
      - apiVersion: v1
        imagePullSecrets:
        - name: open-cluster-management-image-pull-credentials
        kind: ServiceAccount
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: cert-policy-controller
            chart: cert-policy-controller-2.2.0
            heritage: Helm
            release: cert-policy-controller
          name: cert-policy-controller-sa
          namespace: open-cluster-management-agent-addon
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:44Z"
      message: Apply manifest work complete
      observedGeneration: 1
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:44Z"
      message: All resources are available
      observedGeneration: 1
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: certificatepolicies.policy.open-cluster-management.io
          namespace: ""
          ordinal: 0
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: cert-policy-controller
          namespace: open-cluster-management-agent-addon
          ordinal: 1
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:cert-policy-controller
          namespace: ""
          ordinal: 2
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: cert-policy-controller-leader
          namespace: open-cluster-management-agent-addon
          ordinal: 3
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:cert-policy-controller
          namespace: ""
          ordinal: 4
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: cert-policy-controller-leader
          namespace: open-cluster-management-agent-addon
          ordinal: 5
          resource: roles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: cert-policy-controller-sa
          namespace: open-cluster-management-agent-addon
          ordinal: 6
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    annotations:
      open-cluster-management.io/config-spec-hash: '{"managedproxyconfigurations.proxy.open-cluster-management.io//cluster-proxy":"433b812298fa78576c256f24d910e1589eb7d6042b648641e47cf872cb0f2a4f"}'
    creationTimestamp: "2024-10-30T03:06:01Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 1
    labels:
      open-cluster-management.io/addon-name: cluster-proxy
    name: addon-cluster-proxy-deploy-0
    namespace: vm02980
    ownerReferences:
    - apiVersion: addon.open-cluster-management.io/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedClusterAddOn
      name: cluster-proxy
      uid: 276a19d5-c6b6-4f58-9bb4-d3ac66b59297
    resourceVersion: "6032813"
    uid: 8e9e6d10-7f7c-4296-9567-eca0c777e550
  spec:
    deleteOption:
      propagationPolicy: SelectivelyOrphan
      selectivelyOrphans:
        orphaningRules:
        - group: ""
          name: open-cluster-management-agent-addon
          namespace: ""
          resource: namespaces
    workload:
      manifests:
      - apiVersion: v1
        data:
          tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURYekNDQWtlZ0F3SUJBZ0lJSUNKRStLN1RxRlF3RFFZSktvWklodmNOQVFFTEJRQXdNREV1TUN3R0ExVUUKQXhNbGIzQmxiaTFqYkhWemRHVnlMVzFoYm1GblpXMWxiblE2WTJ4MWMzUmxjaTF3Y205NGVUQWVGdzB5TkRFdwpNamt4T0RRek5UQmFGdzB5TlRBME1qY3hPRFF6TlRGYU1Bd3hDakFJQmdOVkJBTU1BU293Z2dFaU1BMEdDU3FHClNJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURQVkd4UVovbWxBYlVRSjBGSUZJVldGRUlUQVR1QzY1ZmMKa1ExaE13SmhRc2w5OWxxenNMK2M1S29BVExxa1VKL1JGd2VtNTZEcHM1MHBWZGdzYzhiWEVXSFNFeE5ub3RXSQp1emdjRGc0VkxleXAwc2F0dDV4VS9SSVgzWE02cjk3aE5UNmtTaVNheDJtQU1Iak9yellVQ3ZGRUYzUkM5SVF0CnlzczdvSjFzY2N3VnpLMFNsRWduaHcrNW1pWjJFekhIRzJWZStEM0I0K2lsaTd5SUZUTER4R2orcHZMNk5ZeFEKN3hiSjM2SXNHNm1GLzVyOWxKWlhubXpQY1dHT25ZS1Zac0hVcjdCbk4yK0grVXRZMmIydmRzNkNIa1hWejdESQo5RkVhZTNIaGIvTXl0MkJ2bWg2aVpHZ2dWQ3VrYmxZVHMxSkJ1ZmdPV3JIWXFoTlVjTlVkQWdNQkFBR2pnYUF3CmdaMHdEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CTUdBMVVkSlFRTU1Bb0dDQ3NHQVFVRkJ3TUJNQXdHQTFVZEV3RUIKL3dRQ01BQXdIUVlEVlIwT0JCWUVGSk1lK1FmVmpocVBDck8ydlA5L0hJNFlVc3hsTUI4R0ExVWRJd1FZTUJhQQpGSFVWUy9NN1ZMbXBiVlFoVENsQjB5YkxJVjVlTUNnR0ExVWRFUVFoTUIrQ0FTcUNDV3h2WTJGc2FHOXpkSUlKCk1USTNMakF1TUM0eGh3Ui9BQUFCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBZ1RjYitXYUgxM3lHdXV1cEQKOUZrdGYrTTFtYkgzNUdaZXhYaVkzUTZWQVpGaDgrU2F0YndWN3g2QUVLY0xVWDRTVitTTjFHb0d0ZTlpaHQ4dgpxbFppazU3TlVsZ3BoRzdjUjA0WTRhQlU4ZUxjdzZ3Z01iZFdyVFpCelYxdE1VZzRuTFlEcHNmcnRjYTE1TVBKCmN0WVJiS2RkeHljL2xDUytLTnNmTTlPbGZVcys2cDZ4UHdZVC9EK2pnQjJaay9aN0RyMm9NTmFTSUhUbW55c0EKc0E4NmxlQlFCeEZON3o0UExYc250N21EVlF4Nkl6Z2pzZk94WDRSUWZSRDg1cHdxdTNodm5QcVFJeERaTlZieQpRNXFNSmVrY1NOVURIQnJOV2E1WUowbk1zNkFPL3JCSnVnQkQrSjNzZEQrdkYxUWtzaVRMZGxPcDFFWU9OVzVIClNnaEgKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJRFZqQ0NBajZnQXdJQkFnSUlHajlaVmNUU1M0Z3dEUVlKS29aSWh2Y05BUUVMQlFBd01ERXVNQ3dHQTFVRQpBeE1sYjNCbGJpMWpiSFZ6ZEdWeUxXMWhibUZuWlcxbGJuUTZZMngxYzNSbGNpMXdjbTk0ZVRBZUZ3MHlOREV3Ck1qa3hPRFF6TXpOYUZ3MHpOREV3TWpjeE9EUXpNek5hTURBeExqQXNCZ05WQkFNVEpXOXdaVzR0WTJ4MWMzUmwKY2kxdFlXNWhaMlZ0Wlc1ME9tTnNkWE4wWlhJdGNISnZlSGt3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQgpEd0F3Z2dFS0FvSUJBUUM0RDhhVVdmblJpYy9VNUxTaVhnb1BuajFkZXhaQzR1V1ZKZWhHTXMyZDhhdS9BVUZnClYwK2tuQ1YxaGo5TDJ3djZubjUzWCt1ZmFUbzl0RE13ZjJkOExxSnQvVjVVSXZMV2pmd0hOTUFaVnR3MGRvRnoKMkVEc0lkRGdmWXBITHh6VUpwL09reTdYS3ZncUM3cUdGT1JiL1V1U3BTNjU1UjR2RCtRWndWekgyZk5DTG8wOQpUM1NHbWFMNEQxT2ZVVUlQYXRGSEczSWJxQ1hnWUpwS1B2MGR6dzR4QXJWbzUrQm1nWjRqbUwvTkJ3K25xN0c1CmpMRzQ3N0VRZVhOaUhGTHg0R0kyYXZKUEVTcDBuQkluMHFMMjBTeXdEelljQXJ1VzF0ajNqZ24xWVV1WnRMWTQKK0Q5R2ttd2d1RjZzQmtlb1ZIL0tyT1BDL3lwOUxvVWRYcUZQQWdNQkFBR2pkREJ5TUE0R0ExVWREd0VCL3dRRQpBd0lDcERBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJSMUZVdnpPMVM1cVcxVUlVd3BRZE1tCnl5RmVYakF3QmdOVkhSRUVLVEFuZ2lWdmNHVnVMV05zZFhOMFpYSXRiV0Z1WVdkbGJXVnVkRHBqYkhWemRHVnkKTFhCeWIzaDVNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNKN216VmRmTnk5WFB3Z1lYcTQwU2c2VnZEOHg1Uwpmalp1SGV3Y2R1OHo3N3A2VTlHUy92MmZYUndrSkFQaDF0RHFSeS81QXBPUDcwZXUvU1JFQzY1WnhoQVkwOWMrCjNMSGQ0dkJoNEluZTZPbnpGaGhmbGtGRWdiWUJuMDdhdXpMVHRpcGtSSG9YTURQSjh6blFIa3hxb0kwaFVjSXMKNnVVL1FjV3R6QWxjdFpiV3hQRm0xeENyUC9qN0lxL2hDSXNZYUVlTGFtZmxsMi9ickJ4aGFhOEpIVlFxR0ZyRgpUMkt6RDZPVXVkT29jbm0vY3Fxb1RtZ09XQnJuVndjdFQvRkE3RS8yN2tObjJWakJFNEFIRVdiMG5PdnhZTlh2CjdRcDN3RElIVUY1UE4zd2dPR2wvMWpiMFZrdXVieGkyekpNeE8wVWIxWFpwbHdGZWNmQ1dQcDlYCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
          tls.key: notsecret
        kind: Secret
        metadata:
          name: cluster-proxy-service-proxy-server-certificates
          namespace: open-cluster-management-agent-addon
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          annotations:
            proxy.open-cluster-management.io/configuration-generation: "1"
          name: cluster-proxy-proxy-agent
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          selector:
            matchLabels:
              open-cluster-management.io/addon: cluster-proxy
              proxy.open-cluster-management.io/component-name: proxy-agent
          strategy: {}
          template:
            metadata:
              annotations:
                proxy.open-cluster-management.io/configuration-generation: "1"
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              creationTimestamp: null
              labels:
                open-cluster-management.io/addon: cluster-proxy
                proxy.open-cluster-management.io/component-name: proxy-agent
            spec:
              containers:
              - args:
                - --proxy-server-host=cluster-proxy-anp.apps.acm-gigantic.rdu2.scalelab.redhat.com
                - --proxy-server-port=443
                - --agent-identifiers=host=cluster-proxy-2659b6655cc920fbb6f9a1c07217be6366019e8127acd8f08
                - --ca-cert=/etc/ca/ca.crt
                - --agent-cert=/etc/tls/tls.crt
                - --agent-key=/etc/tls/tls.key
                command:
                - /proxy-agent
                env:
                - name: ROOT_CA_CERT
                  value: /etc/ca/ca.crt
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/cluster-proxy-addon-rhel9@sha256:c37befd0c2d8746d3051a03e9298fa3e9a7ba9c960672792c293d1131c54f198
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  failureThreshold: 1
                  httpGet:
                    path: /healthz
                    port: 8888
                    scheme: HTTP
                  initialDelaySeconds: 10
                  periodSeconds: 10
                name: proxy-agent
                resources: {}
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                  runAsNonRoot: true
                volumeMounts:
                - mountPath: /etc/ca
                  name: ca
                  readOnly: true
                - mountPath: /etc/tls
                  name: hub
                  readOnly: true
              - args:
                - --v=2
                - --hub-kubeconfig=/etc/kubeconfig/kubeconfig
                - --cluster-name=vm02980
                - --proxy-server-namespace=multicluster-engine
                command:
                - /agent
                env:
                - name: POD_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/cluster-proxy-rhel9@sha256:a4d01b330c24dd1f3634207a4eadcb53fca4692008e3987f76c4000d6c1b9e12
                imagePullPolicy: IfNotPresent
                name: addon-agent
                resources: {}
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                  runAsNonRoot: true
                volumeMounts:
                - mountPath: /etc/kubeconfig/
                  name: hub-kubeconfig
                  readOnly: true
                - mountPath: /etc/tls
                  name: hub
                  readOnly: true
              - args:
                - service-proxy
                - --ocpservice-ca=/ocpservice-ca/service-ca.crt
                - --cert=/server-cert/tls.crt
                - --key=/server-cert/tls.key
                command:
                - /cluster-proxy
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/cluster-proxy-addon-rhel9@sha256:c37befd0c2d8746d3051a03e9298fa3e9a7ba9c960672792c293d1131c54f198
                imagePullPolicy: IfNotPresent
                name: service-proxy
                resources: {}
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                  runAsNonRoot: true
                volumeMounts:
                - mountPath: /ocpservice-ca
                  name: ocpservice-ca
                  readOnly: true
                - mountPath: /server-cert
                  name: service-proxy-server-cert
                  readOnly: true
              imagePullSecrets:
              - name: open-cluster-management-image-pull-credentials
              serviceAccount: cluster-proxy
              tolerations:
              - effect: NoSchedule
                key: dedicated
                operator: Equal
                value: infra
              - effect: NoSchedule
                key: node-role.kubernetes.io/infra
                operator: Exists
              volumes:
              - name: ca
                secret:
                  secretName: cluster-proxy-ca
              - name: hub
                secret:
                  secretName: cluster-proxy-open-cluster-management.io-proxy-agent-signer-client-cert
              - name: hub-kubeconfig
                secret:
                  secretName: cluster-proxy-hub-kubeconfig
              - configMap:
                  name: openshift-service-ca.crt
                  optional: true
                name: ocpservice-ca
              - name: service-proxy-server-cert
                secret:
                  secretName: cluster-proxy-service-proxy-server-certificates
        status: {}
      - apiVersion: v1
        data:
          ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWakNDQWo2Z0F3SUJBZ0lJR2o5WlZjVFNTNGd3RFFZSktvWklodmNOQVFFTEJRQXdNREV1TUN3R0ExVUUKQXhNbGIzQmxiaTFqYkhWemRHVnlMVzFoYm1GblpXMWxiblE2WTJ4MWMzUmxjaTF3Y205NGVUQWVGdzB5TkRFdwpNamt4T0RRek16TmFGdzB6TkRFd01qY3hPRFF6TXpOYU1EQXhMakFzQmdOVkJBTVRKVzl3Wlc0dFkyeDFjM1JsCmNpMXRZVzVoWjJWdFpXNTBPbU5zZFhOMFpYSXRjSEp2ZUhrd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUIKRHdBd2dnRUtBb0lCQVFDNEQ4YVVXZm5SaWMvVTVMU2lYZ29QbmoxZGV4WkM0dVdWSmVoR01zMmQ4YXUvQVVGZwpWMCtrbkNWMWhqOUwyd3Y2bm41M1grdWZhVG85dERNd2YyZDhMcUp0L1Y1VUl2TFdqZndITk1BWlZ0dzBkb0Z6CjJFRHNJZERnZllwSEx4elVKcC9Pa3k3WEt2Z3FDN3FHRk9SYi9VdVNwUzY1NVI0dkQrUVp3VnpIMmZOQ0xvMDkKVDNTR21hTDREMU9mVVVJUGF0RkhHM0licUNYZ1lKcEtQdjBkenc0eEFyVm81K0JtZ1o0am1ML05CdytucTdHNQpqTEc0NzdFUWVYTmlIRkx4NEdJMmF2SlBFU3AwbkJJbjBxTDIwU3l3RHpZY0FydVcxdGozamduMVlVdVp0TFk0CitEOUdrbXdndUY2c0JrZW9WSC9Lck9QQy95cDlMb1VkWHFGUEFnTUJBQUdqZERCeU1BNEdBMVVkRHdFQi93UUUKQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUjFGVXZ6TzFTNXFXMVVJVXdwUWRNbQp5eUZlWGpBd0JnTlZIUkVFS1RBbmdpVnZjR1Z1TFdOc2RYTjBaWEl0YldGdVlXZGxiV1Z1ZERwamJIVnpkR1Z5CkxYQnliM2g1TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDSjdtelZkZk55OVhQd2dZWHE0MFNnNlZ2RDh4NVMKZmpadUhld2NkdTh6NzdwNlU5R1MvdjJmWFJ3a0pBUGgxdERxUnkvNUFwT1A3MGV1L1NSRUM2NVp4aEFZMDljKwozTEhkNHZCaDRJbmU2T256RmhoZmxrRkVnYllCbjA3YXV6TFR0aXBrUkhvWE1EUEo4em5RSGt4cW9JMGhVY0lzCjZ1VS9RY1d0ekFsY3RaYld4UEZtMXhDclAvajdJcS9oQ0lzWWFFZUxhbWZsbDIvYnJCeGhhYThKSFZRcUdGckYKVDJLekQ2T1V1ZE9vY25tL2NxcW9UbWdPV0JyblZ3Y3RUL0ZBN0UvMjdrTm4yVmpCRTRBSEVXYjBuT3Z4WU5Ydgo3UXAzd0RJSFVGNVBOM3dnT0dsLzFqYjBWa3V1YnhpMnpKTXhPMFViMVhacGx3RmVjZkNXUHA5WAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
        kind: Secret
        metadata:
          name: cluster-proxy-ca
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          name: cluster-proxy-addon-agent
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: cluster-proxy-addon-agent
        subjects:
        - kind: ServiceAccount
          name: cluster-proxy
          namespace: open-cluster-management-agent-addon
      - apiVersion: v1
        kind: Service
        metadata:
          name: cluster-proxy-2659b6655cc920fbb6f9a1c07217be6366019e8127acd8f08
          namespace: open-cluster-management-agent-addon
        spec:
          externalName: cluster-proxy-service-proxy.open-cluster-management-agent-addon.svc.cluster.local
          type: ExternalName
        status:
          loadBalancer: {}
      - apiVersion: v1
        kind: Service
        metadata:
          name: cluster-proxy-service-proxy
          namespace: open-cluster-management-agent-addon
        spec:
          ports:
          - name: service-proxy
            port: 7443
            targetPort: 0
          selector:
            open-cluster-management.io/addon: cluster-proxy
        status:
          loadBalancer: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          name: cluster-proxy-addon-agent
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - '*'
      - apiVersion: v1
        kind: Namespace
        metadata:
          annotations:
            addon.open-cluster-management.io/deletion-orphan: ""
          name: open-cluster-management-agent-addon
        spec: {}
        status: {}
      - apiVersion: v1
        kind: ServiceAccount
        metadata:
          name: cluster-proxy
          namespace: open-cluster-management-agent-addon
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:42Z"
      message: Apply manifest work complete
      observedGeneration: 1
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:42Z"
      message: All resources are available
      observedGeneration: 1
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: cluster-proxy-service-proxy-server-certificates
          namespace: open-cluster-management-agent-addon
          ordinal: 0
          resource: secrets
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: cluster-proxy-proxy-agent
          namespace: open-cluster-management-agent-addon
          ordinal: 1
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: cluster-proxy-ca
          namespace: open-cluster-management-agent-addon
          ordinal: 2
          resource: secrets
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: cluster-proxy-addon-agent
          namespace: open-cluster-management-agent-addon
          ordinal: 3
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Service
          name: cluster-proxy-2659b6655cc920fbb6f9a1c07217be6366019e8127acd8f08
          namespace: open-cluster-management-agent-addon
          ordinal: 4
          resource: services
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Service
          name: cluster-proxy-service-proxy
          namespace: open-cluster-management-agent-addon
          ordinal: 5
          resource: services
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: cluster-proxy-addon-agent
          namespace: open-cluster-management-agent-addon
          ordinal: 6
          resource: roles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: open-cluster-management-agent-addon
          namespace: ""
          ordinal: 7
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: cluster-proxy
          namespace: open-cluster-management-agent-addon
          ordinal: 8
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    creationTimestamp: "2024-10-30T03:58:42Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 2
    labels:
      open-cluster-management.io/addon-name: config-policy-controller
    name: addon-config-policy-controller-deploy-0
    namespace: vm02980
    ownerReferences:
    - apiVersion: addon.open-cluster-management.io/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedClusterAddOn
      name: config-policy-controller
      uid: 702319a3-fa22-4061-8e33-2c2a87256838
    resourceVersion: "6038839"
    uid: 62fc4aca-db76-422f-8068-8f64772c9b62
  spec:
    deleteOption:
      propagationPolicy: SelectivelyOrphan
      selectivelyOrphans:
        orphaningRules:
        - group: ""
          name: open-cluster-management-agent-addon
          namespace: ""
          resource: namespaces
    workload:
      manifests:
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.16.3
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            policy.open-cluster-management.io/policy-type: template
          name: configurationpolicies.policy.open-cluster-management.io
        spec:
          group: policy.open-cluster-management.io
          names:
            kind: ConfigurationPolicy
            listKind: ConfigurationPolicyList
            plural: configurationpolicies
            singular: configurationpolicy
          scope: Namespaced
          versions:
          - additionalPrinterColumns:
            - jsonPath: .status.compliant
              name: Compliance state
              type: string
            name: v1
            schema:
              openAPIV3Schema:
                description: ConfigurationPolicy is the schema for the configurationpolicies
                  API. A configuration policy contains, in whole or in part, an object
                  definition to compare with objects on the cluster. If the definition
                  of the configuration policy doesn't match the objects on the cluster,
                  a noncompliant status is displayed. Furthermore, if the RemediationAction
                  is set to `enforce` and the name of the object is available, the
                  configuration policy controller creates or updates the object to
                  match in order to make the configuration policy compliant.
                properties:
                  apiVersion:
                    description: 'APIVersion defines the versioned schema of this
                      representation of an object. Servers should convert recognized
                      schemas to the latest internal value, and may reject unrecognized
                      values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                    type: string
                  kind:
                    description: 'Kind is a string value representing the REST resource
                      this object represents. Servers may infer this from the endpoint
                      the client submits requests to. Cannot be updated. In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                    type: string
                  metadata:
                    type: object
                  spec:
                    description: ConfigurationPolicySpec defines the desired configuration
                      of objects on the cluster, along with how the controller should
                      handle when the cluster doesn't match the configuration policy.
                    oneOf:
                    - required:
                      - object-templates
                    - required:
                      - object-templates-raw
                    properties:
                      customMessage:
                        description: CustomMessage configures the compliance messages
                          emitted by the configuration policy, to use one of the specified
                          Go templates based on the current compliance. The data passed
                          to the templates include a `.DefaultMessage` string variable
                          which matches the message that would be emitted if no custom
                          template was defined, and a `.Policy` object variable which
                          contains the full current state of the policy. If the policy
                          is using Kubernetes API watches (default but can be configured
                          with EvaluationInterval), and the object exists, then the
                          full state of each related object will be available at `.Policy.status.relatedObjects[*].object`.
                          Otherwise, only the identifier information will be available
                          there.
                        properties:
                          compliant:
                            description: Compliant is the template used for the compliance
                              message when the policy is compliant.
                            type: string
                          noncompliant:
                            description: NonCompliant is the template used for the
                              compliance message when the policy is not compliant,
                              including when the status is unknown.
                            type: string
                        type: object
                      evaluationInterval:
                        description: EvaluationInterval configures the minimum elapsed
                          time before a configuration policy is reevaluated. The default
                          value is `watch` to leverage Kubernetes API watches instead
                          of polling the Kubernetes API server. If the policy spec
                          is changed or if the list of namespaces selected by the
                          policy changes, the policy might be evaluated regardless
                          of the settings here.
                        properties:
                          compliant:
                            description: Compliant is the minimum elapsed time before
                              a configuration policy is reevaluated when in the compliant
                              state. Set this to `never` to disable reevaluation when
                              in the compliant state. The default value is `watch`.
                            pattern: ^(?:(?:(?:[0-9]+(?:.[0-9])?)(?:h|m|s|(?:ms)|(?:us)|(?:ns)))|never|watch)+$
                            type: string
                          noncompliant:
                            description: NonCompliant is the minimum elapsed time
                              before a configuration policy is reevaluated when in
                              the noncompliant state. Set this to `never` to disable
                              reevaluation when in the noncompliant state. The default
                              value is `watch`.
                            pattern: ^(?:(?:(?:[0-9]+(?:.[0-9])?)(?:h|m|s|(?:ms)|(?:us)|(?:ns)))|never|watch)+$
                            type: string
                        type: object
                      namespaceSelector:
                        description: NamespaceSelector defines the list of namespaces
                          to include or exclude for objects defined in `spec["object-templates"]`.
                          All selector rules are combined. If 'include' is not provided
                          but `matchLabels` and/or `matchExpressions` are, `include`
                          will behave as if `['*']` were given. If `matchExpressions`
                          and `matchLabels` are both not provided, `include` must
                          be provided to retrieve namespaces.
                        properties:
                          exclude:
                            description: Exclude is an array of filepath expressions
                              to exclude objects by name.
                            items:
                              minLength: 1
                              type: string
                            type: array
                          include:
                            description: Include is an array of filepath expressions
                              to include objects by name.
                            items:
                              minLength: 1
                              type: string
                            type: array
                          matchExpressions:
                            description: MatchExpressions is an array of label selector
                              requirements matching objects by label.
                            items:
                              description: A label selector requirement is a selector
                                that contains values, a key, and an operator that
                                relates the key and values.
                              properties:
                                key:
                                  description: key is the label key that the selector
                                    applies to.
                                  type: string
                                operator:
                                  description: operator represents a key's relationship
                                    to a set of values. Valid operators are In, NotIn,
                                    Exists and DoesNotExist.
                                  type: string
                                values:
                                  description: values is an array of string values.
                                    If the operator is In or NotIn, the values array
                                    must be non-empty. If the operator is Exists or
                                    DoesNotExist, the values array must be empty.
                                    This array is replaced during a strategic merge
                                    patch.
                                  items:
                                    type: string
                                  type: array
                                  x-kubernetes-list-type: atomic
                              required:
                              - key
                              - operator
                              type: object
                            type: array
                          matchLabels:
                            additionalProperties:
                              type: string
                            description: MatchLabels is a map of {key,value} pairs
                              matching objects by label.
                            type: object
                        type: object
                      object-templates:
                        description: The `object-templates` is an array of object
                          configurations for the configuration policy to check, create,
                          modify, or delete objects on the cluster. Keys inside of
                          the objectDefinition in an object template may point to
                          values that have Go templates. For more advanced Go templating
                          such as `range` loops and `if` conditionals, use `object-templates-raw`.
                          Only one of `object-templates` and `object-templates-raw`
                          can be set in a configuration policy. For more on the Go
                          templates, see https://github.com/stolostron/go-template-utils/blob/main/README.md.
                        items:
                          description: ObjectTemplate describes the desired state
                            of an object on the cluster.
                          properties:
                            complianceType:
                              description: ComplianceType describes how objects on
                                the cluster should be compared with the object definition
                                of the configuration policy. The supported options
                                are `MustHave`, `MustOnlyHave`, or `MustNotHave`.
                              enum:
                              - MustHave
                              - Musthave
                              - musthave
                              - MustOnlyHave
                              - Mustonlyhave
                              - mustonlyhave
                              - MustNotHave
                              - Mustnothave
                              - mustnothave
                              type: string
                            metadataComplianceType:
                              description: MetadataComplianceType describes how the
                                labels and annotations of objects on the cluster should
                                be compared with the object definition of the configuration
                                policy. The supported options are `MustHave` or `MustOnlyHave`.
                                The default value is the value defined in `complianceType`
                                for the object template.
                              enum:
                              - MustHave
                              - Musthave
                              - musthave
                              - MustOnlyHave
                              - Mustonlyhave
                              - mustonlyhave
                              type: string
                            objectDefinition:
                              description: ObjectDefinition defines required fields
                                to be compared with objects on the cluster.
                              type: object
                              x-kubernetes-preserve-unknown-fields: true
                            recordDiff:
                              description: RecordDiff specifies whether and where
                                to log the difference between the object on the cluster
                                and the `objectDefinition` parameter in the policy.
                                The supported options are `InStatus` to record the
                                difference in the policy status field, `Log` to log
                                the difference in the `config-policy-controller` pod,
                                and `None` to not log the difference. The default
                                value is `None` for object kinds that include sensitive
                                data such as `ConfigMap`, `OAuthAccessToken`, `OAuthAuthorizeTokens`,
                                `Route`, and `Secret`, or when a templated `objectDefinition`
                                references sensitive data. For all other kinds, the
                                default value is `InStatus`.
                              enum:
                              - Log
                              - InStatus
                              - None
                              type: string
                            recreateOption:
                              default: None
                              description: RecreateOption describes when to delete
                                and recreate an object when an update is required.
                                When you set the object to `IfRequired`, the policy
                                recreates the object when updating an immutable field.
                                When you set the parameter to `Always`, the policy
                                recreates the object on any update. When you set the
                                `remediationAction` to `inform`, the parameter value,
                                `recreateOption`, has no effect on the object. The
                                `IfRequired` value has no effect on clusters without
                                dry-run update support. The default value is `None`.
                              enum:
                              - None
                              - IfRequired
                              - Always
                              type: string
                          required:
                          - complianceType
                          - objectDefinition
                          type: object
                        type: array
                      object-templates-raw:
                        description: The `object-templates-raw` is a string containing
                          Go templates that must ultimately produce an array of object
                          configurations in YAML format to be used as `object-templates`.
                          Only one of `object-templates` and `object-templates-raw`
                          can be set in a configuration policy. For more on the Go
                          templates, see https://github.com/stolostron/go-template-utils/blob/main/README.md.
                        type: string
                      pruneObjectBehavior:
                        default: None
                        description: 'PruneObjectBehavior is used to remove objects
                          that are managed by the policy upon either case: a change
                          to the policy that causes an object to no longer be managed
                          by the policy, or the deletion of the policy.'
                        enum:
                        - DeleteAll
                        - DeleteIfCreated
                        - None
                        type: string
                      remediationAction:
                        description: RemediationAction is the remediation of the policy.
                          The parameter values are `enforce` and `inform`.
                        enum:
                        - Inform
                        - inform
                        - Enforce
                        - enforce
                        type: string
                      severity:
                        description: Severity is a user-defined severity for when
                          an object is noncompliant with this configuration policy.
                          The supported options are `low`, `medium`, `high`, and `critical`.
                        enum:
                        - low
                        - Low
                        - medium
                        - Medium
                        - high
                        - High
                        - critical
                        - Critical
                        type: string
                    required:
                    - remediationAction
                    type: object
                  status:
                    description: ConfigurationPolicyStatus is the observed status
                      of the configuration policy from its object definitions.
                    properties:
                      compliancyDetails:
                        description: CompliancyDetails is a list of statuses matching
                          one-to-one with each of the items in the `object-templates`
                          array.
                        items:
                          description: TemplateStatus reports the compliance details
                            from the definitions in an `object-template`.
                          properties:
                            Compliant:
                              description: ComplianceState reports the observed status
                                from the definitions of the policy.
                              enum:
                              - Compliant
                              - Pending
                              - NonCompliant
                              - Terminating
                              type: string
                            Validity:
                              description: Deprecated
                              properties:
                                reason:
                                  type: string
                                valid:
                                  type: boolean
                              type: object
                            conditions:
                              description: Conditions contains the details from the
                                latest evaluation of the `object-template`.
                              items:
                                description: Condition contains the details of an
                                  evaluation of an `object-template`.
                                properties:
                                  lastTransitionTime:
                                    description: LastTransitionTime is the most recent
                                      time the condition transitioned to the current
                                      condition.
                                    format: date-time
                                    type: string
                                  message:
                                    description: Message is a human-readable message
                                      indicating details about the condition.
                                    type: string
                                  reason:
                                    description: Reason is a brief summary for the
                                      condition.
                                    type: string
                                  status:
                                    description: Status is an unused field. If set,
                                      it's set to `True`.
                                    type: string
                                  type:
                                    description: Type is the type of condition. The
                                      supported options are `violation` or `notification`.
                                    type: string
                                required:
                                - type
                                type: object
                              type: array
                          type: object
                        type: array
                      compliant:
                        description: ComplianceState reports the observed status from
                          the definitions of the policy.
                        enum:
                        - Compliant
                        - Pending
                        - NonCompliant
                        - Terminating
                        type: string
                      lastEvaluated:
                        description: LastEvaluated is an ISO-8601 timestamp of the
                          last time the policy was evaluated.
                        type: string
                      lastEvaluatedGeneration:
                        description: LastEvaluatedGeneration is the generation of
                          the ConfigurationPolicy object when it was last evaluated.
                        format: int64
                        type: integer
                      relatedObjects:
                        description: RelatedObjects is a list of objects processed
                          by the configuration policy due to its `object-templates`.
                        items:
                          description: RelatedObject contains the details of an object
                            matched by the policy.
                          properties:
                            compliant:
                              description: Compliant represents whether the related
                                object is compliant with the definition of the policy.
                              type: string
                            object:
                              description: ObjectResource contains the identifying
                                fields of the related object.
                              properties:
                                apiVersion:
                                  description: API version of the related object.
                                  type: string
                                kind:
                                  description: Kind of the related object.
                                  type: string
                                metadata:
                                  description: ObjectMetadata contains the metadata
                                    for an object matched by the configuration policy.
                                  properties:
                                    name:
                                      description: Name of the related object.
                                      type: string
                                    namespace:
                                      description: Namespace of the related object.
                                      type: string
                                  type: object
                              type: object
                            properties:
                              description: Properties are additional properties of
                                the related object relevant to the configuration policy.
                              properties:
                                createdByPolicy:
                                  description: CreatedByPolicy reports whether the
                                    object was created by the configuration policy,
                                    which is important when pruning is configured.
                                  type: boolean
                                diff:
                                  description: Diff stores the difference between
                                    the `objectDefinition` in the policy and the object
                                    on the cluster.
                                  type: string
                                uid:
                                  description: UID stores the object UID to help track
                                    object ownership for deletion when pruning is
                                    configured.
                                  type: string
                              type: object
                            reason:
                              description: Reason is a human-readable message of why
                                the related object has a particular compliance.
                              type: string
                          type: object
                        type: array
                    type: object
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.16.3
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            policy.open-cluster-management.io/policy-type: template
          name: operatorpolicies.policy.open-cluster-management.io
        spec:
          group: policy.open-cluster-management.io
          names:
            kind: OperatorPolicy
            listKind: OperatorPolicyList
            plural: operatorpolicies
            singular: operatorpolicy
          scope: Namespaced
          versions:
          - name: v1beta1
            schema:
              openAPIV3Schema:
                description: OperatorPolicy is the schema for the operatorpolicies
                  API. You can use the operator policy to manage operators by providing
                  automation for their management and reporting on the status across
                  the various operator objects.
                properties:
                  apiVersion:
                    description: 'APIVersion defines the versioned schema of this
                      representation of an object. Servers should convert recognized
                      schemas to the latest internal value, and may reject unrecognized
                      values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                    type: string
                  kind:
                    description: 'Kind is a string value representing the REST resource
                      this object represents. Servers may infer this from the endpoint
                      the client submits requests to. Cannot be updated. In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                    type: string
                  metadata:
                    type: object
                  spec:
                    description: OperatorPolicySpec defines the desired state of a
                      particular operator on the cluster.
                    properties:
                      complianceConfig:
                        default: {}
                        description: ComplianceConfig defines how resource statuses
                          affect the OperatorPolicy status and compliance. When set
                          to Compliant, the condition does not impact the OperatorPolicy
                          compliance. When set to NonCompliant, the condition causes
                          the OperatorPolicy to become NonCompliant.
                        properties:
                          catalogSourceUnhealthy:
                            default: Compliant
                            description: CatalogSourceUnhealthy specifies how the
                              CatalogSourceUnhealthy typed condition should affect
                              overall policy compliance. The default value is `Compliant`.
                            enum:
                            - Compliant
                            - NonCompliant
                            type: string
                          deploymentsUnavailable:
                            default: NonCompliant
                            description: DeploymentsUnavailable specifies how the
                              DeploymentCompliant typed condition should affect overall
                              policy compliance. The default value is `NonCompliant`.
                            enum:
                            - Compliant
                            - NonCompliant
                            type: string
                          upgradesAvailable:
                            default: Compliant
                            description: UpgradesAvailable specifies how the InstallPlanCompliant
                              typed condition should affect overall policy compliance.
                              The default value is `Compliant`.
                            enum:
                            - Compliant
                            - NonCompliant
                            type: string
                        type: object
                      complianceType:
                        description: ComplianceType specifies the desired state of
                          the operator on the cluster. If set to `musthave`, the policy
                          is compliant when the operator is found. If set to `mustnothave`,
                          the policy is compliant when the operator is not found.
                        enum:
                        - musthave
                        - mustnothave
                        type: string
                      operatorGroup:
                        description: OperatorGroup specifies which `OperatorGroup`
                          to inspect. Include the name, namespace, and any `spec`
                          fields for the operator group. For more info, see `kubectl
                          explain operatorgroups.spec` or view https://olm.operatorframework.io/docs/concepts/crds/operatorgroup/.
                        type: object
                        x-kubernetes-preserve-unknown-fields: true
                      remediationAction:
                        description: RemediationAction is the remediation of the policy.
                          The parameter values are `enforce` and `inform`.
                        enum:
                        - Inform
                        - inform
                        - Enforce
                        - enforce
                        type: string
                      removalBehavior:
                        default: {}
                        description: Use RemovalBehavior to define what resources
                          need to be removed when enforcing `mustnothave` policies.
                          When in `inform` mode, any resources that are deleted if
                          the policy is set to `enforce` makes the policy noncompliant,
                          but resources that are kept are compliant.
                        properties:
                          clusterServiceVersions:
                            allOf:
                            - enum:
                              - Keep
                              - Delete
                              - DeleteIfUnused
                            - enum:
                              - Keep
                              - Delete
                            default: Delete
                            description: Use the `clusterServiceVersions` parameter
                              to specify whether to delete the ClusterServiceVersion.
                              The default value is `Delete`.
                            type: string
                          customResourceDefinitions:
                            allOf:
                            - enum:
                              - Keep
                              - Delete
                              - DeleteIfUnused
                            - enum:
                              - Keep
                              - Delete
                            default: Keep
                            description: Use the customResourceDefinitions parameter
                              to specify whether to delete any CustomResourceDefinitions
                              associated with the operator. The default value is `Keep`,
                              because deleting them should be done deliberately.
                            type: string
                          operatorGroups:
                            allOf:
                            - enum:
                              - Keep
                              - Delete
                              - DeleteIfUnused
                            - enum:
                              - Keep
                              - DeleteIfUnused
                            default: DeleteIfUnused
                            description: Use the `operatorGroups` parameter to specify
                              whether to delete the OperatorGroup. The default value
                              is `DeleteIfUnused`, which only deletes the OperatorGroup
                              if there is not another resource using it.
                            type: string
                          subscriptions:
                            allOf:
                            - enum:
                              - Keep
                              - Delete
                              - DeleteIfUnused
                            - enum:
                              - Keep
                              - Delete
                            default: Delete
                            description: Use the `subscriptions` parameter to specify
                              whether to delete the Subscription. The default value
                              is `Delete`.
                            type: string
                        type: object
                      severity:
                        description: Severity is a user-defined severity for when
                          an object is noncompliant with this configuration policy.
                          The supported options are `low`, `medium`, `high`, and `critical`.
                        enum:
                        - low
                        - Low
                        - medium
                        - Medium
                        - high
                        - High
                        - critical
                        - Critical
                        type: string
                      subscription:
                        description: Subscription specifies which operator `Subscription`
                          resource to inspect. Include the namespace, and any `spec`
                          fields for the Subscription. For more info, see `kubectl
                          explain subscriptions.operators.coreos.com.spec` or view
                          https://olm.operatorframework.io/docs/concepts/crds/subscription/.
                        type: object
                        x-kubernetes-preserve-unknown-fields: true
                      upgradeApproval:
                        description: UpgradeApproval determines whether 'upgrade'
                          InstallPlans for the operator will be approved by the controller
                          when the policy is enforced and in 'musthave' mode. The
                          initial InstallPlan approval is not affected by this setting.
                          This setting has no effect when the policy is in 'mustnothave'
                          mode. Allowed values are "None" or "Automatic".
                        enum:
                        - None
                        - Automatic
                        type: string
                      versions:
                        description: Versions is a list of non-empty strings that
                          specifies which installed versions are compliant when in
                          `inform` mode and which `InstallPlans` are approved when
                          in `enforce` mode.
                        items:
                          minLength: 1
                          type: string
                        type: array
                    required:
                    - complianceType
                    - subscription
                    - upgradeApproval
                    type: object
                  status:
                    description: OperatorPolicyStatus is the observed state of the
                      operators from the specifications given in the operator policy.
                    properties:
                      compliant:
                        description: ComplianceState reports the most recent compliance
                          state of the operator policy.
                        enum:
                        - Compliant
                        - Pending
                        - NonCompliant
                        - Terminating
                        type: string
                      conditions:
                        description: Conditions includes historic details on the condition
                          of the operator policy.
                        items:
                          description: Condition contains details for one aspect of
                            the current state of this API Resource.
                          properties:
                            lastTransitionTime:
                              description: lastTransitionTime is the last time the
                                condition transitioned from one status to another.
                                This should be when the underlying condition changed.  If
                                that is not known, then using the time when the API
                                field changed is acceptable.
                              format: date-time
                              type: string
                            message:
                              description: message is a human readable message indicating
                                details about the transition. This may be an empty
                                string.
                              maxLength: 32768
                              type: string
                            observedGeneration:
                              description: observedGeneration represents the .metadata.generation
                                that the condition was set based upon. For instance,
                                if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
                                is 9, the condition is out of date with respect to
                                the current state of the instance.
                              format: int64
                              minimum: 0
                              type: integer
                            reason:
                              description: reason contains a programmatic identifier
                                indicating the reason for the condition's last transition.
                                Producers of specific condition types may define expected
                                values and meanings for this field, and whether the
                                values are considered a guaranteed API. The value
                                should be a CamelCase string. This field may not be
                                empty.
                              maxLength: 1024
                              minLength: 1
                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                              type: string
                            status:
                              description: status of the condition, one of True, False,
                                Unknown.
                              enum:
                              - "True"
                              - "False"
                              - Unknown
                              type: string
                            type:
                              description: type of condition in CamelCase or in foo.example.com/CamelCase.
                              maxLength: 316
                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                              type: string
                          required:
                          - lastTransitionTime
                          - message
                          - reason
                          - status
                          - type
                          type: object
                        type: array
                        x-kubernetes-list-map-keys:
                        - type
                        x-kubernetes-list-type: map
                      observedGeneration:
                        description: ObservedGeneration is the latest generation observed
                          by the controller.
                        format: int64
                        type: integer
                      overlappingPolicies:
                        description: The list of overlapping OperatorPolicies (as
                          name.namespace) which all manage the same subscription,
                          including this policy. When no overlapping is detected,
                          this list will be empty.
                        items:
                          type: string
                        type: array
                      relatedObjects:
                        description: RelatedObjects reports a list of resources associated
                          with the operator policy.
                        items:
                          description: RelatedObject contains the details of an object
                            matched by the policy.
                          properties:
                            compliant:
                              description: Compliant represents whether the related
                                object is compliant with the definition of the policy.
                              type: string
                            object:
                              description: ObjectResource contains the identifying
                                fields of the related object.
                              properties:
                                apiVersion:
                                  description: API version of the related object.
                                  type: string
                                kind:
                                  description: Kind of the related object.
                                  type: string
                                metadata:
                                  description: ObjectMetadata contains the metadata
                                    for an object matched by the configuration policy.
                                  properties:
                                    name:
                                      description: Name of the related object.
                                      type: string
                                    namespace:
                                      description: Namespace of the related object.
                                      type: string
                                  type: object
                              type: object
                            properties:
                              description: Properties are additional properties of
                                the related object relevant to the configuration policy.
                              properties:
                                createdByPolicy:
                                  description: CreatedByPolicy reports whether the
                                    object was created by the configuration policy,
                                    which is important when pruning is configured.
                                  type: boolean
                                uid:
                                  description: UID stores the object UID to help track
                                    object ownership for deletion when pruning is
                                    configured.
                                  type: string
                              type: object
                            reason:
                              description: Reason is a human-readable message of why
                                the related object has a particular compliance.
                              type: string
                          type: object
                        type: array
                      resolvedSubscriptionLabel:
                        description: The resolved name.namespace of the subscription
                        type: string
                      subscriptionInterventionTime:
                        description: Timestamp for a possible intervention to help
                          a Subscription stuck with a ConstraintsNotSatisfiable condition.
                          Can be in the future, indicating the policy is waiting for
                          OLM to resolve the situation. If in the recent past, the
                          policy may update the status of the Subscription.
                        format: date-time
                        type: string
                    type: object
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          annotations:
            policy.open-cluster-management.io/uninstalling: "false"
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: config-policy-controller
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          selector:
            matchLabels:
              app: config-policy-controller
              release: config-policy-controller
          strategy:
            type: Recreate
          template:
            metadata:
              annotations:
                kubectl.kubernetes.io/default-container: config-policy-controller
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              labels:
                app: config-policy-controller
                chart: config-policy-controller-2.2.0
                heritage: Helm
                release: config-policy-controller
            spec:
              affinity: {}
              containers:
              - args:
                - controller
                - --enable-lease=true
                - --cluster-name=vm02980
                - --leader-elect=false
                - --log-encoder=console
                - --log-level=0
                - --v=-1
                - --evaluation-concurrency=2
                - --client-max-qps=30
                - --client-burst=45
                - --health-probe-bind-address=:8081
                - --secure-metrics=true
                - --metrics-bind-address=0.0.0.0:8443
                - --enable-operator-policy=true
                - --operator-policy-default-namespace=openshift-operators
                command:
                - config-policy-controller
                env:
                - name: WATCH_NAMESPACE
                  value: vm02980
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: OPERATOR_NAME
                  value: config-policy-controller
                - name: HTTP_PROXY
                - name: HTTPS_PROXY
                - name: NO_PROXY
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/config-policy-controller-rhel9@sha256:4f783ad6cd193c584a44c68930333fc7b9aa29bfa1c4563a058ace2510b02e88
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /healthz
                    port: 8081
                  periodSeconds: 10
                name: config-policy-controller
                ports:
                - containerPort: 8443
                  name: metrics
                  protocol: TCP
                readinessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /readyz
                    port: 8081
                  periodSeconds: 10
                resources:
                  limits:
                    memory: 512Mi
                  requests:
                    memory: 128Mi
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                startupProbe:
                  failureThreshold: 30
                  httpGet:
                    path: /readyz
                    port: 8081
                  periodSeconds: 10
                volumeMounts:
                - mountPath: /var/run/metrics-cert
                  name: metrics-cert
                  readOnly: true
                - mountPath: /var/run/klusterlet
                  name: klusterlet-config
              imagePullSecrets:
              - name: open-cluster-management-image-pull-credentials
              securityContext:
                runAsNonRoot: true
                seccompProfile:
                  type: RuntimeDefault
              serviceAccount: config-policy-controller-sa
              terminationGracePeriodSeconds: 120
              tolerations:
              - effect: NoSchedule
                key: dedicated
                operator: Equal
                value: infra
              - effect: NoSchedule
                key: node-role.kubernetes.io/infra
                operator: Exists
              volumes:
              - name: klusterlet-config
                secret:
                  secretName: config-policy-controller-hub-kubeconfig
              - name: metrics-cert
                secret:
                  secretName: config-policy-controller-metrics
        status: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: config-policy-controller-leader
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: config-policy-controller-leader
        subjects:
        - kind: ServiceAccount
          name: config-policy-controller-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: open-cluster-management:config-policy-controller
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:config-policy-controller
        subjects:
        - kind: ServiceAccount
          name: config-policy-controller-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: config-policy-controller-leader
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - get
          - list
          - watch
          - create
          - update
          - patch
          - delete
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
          - patch
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: open-cluster-management:config-policy-controller
        rules:
        - apiGroups:
          - '*'
          resources:
          - '*'
          verbs:
          - '*'
        - nonResourceURLs:
          - '*'
          verbs:
          - '*'
      - apiVersion: v1
        imagePullSecrets:
        - name: open-cluster-management-image-pull-credentials
        kind: ServiceAccount
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: config-policy-controller-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: v1
        kind: Namespace
        metadata:
          annotations:
            addon.open-cluster-management.io/deletion-orphan: ""
          labels:
            openshift.io/cluster-monitoring: "true"
          name: open-cluster-management-agent-addon
        spec: {}
        status: {}
      - apiVersion: monitoring.coreos.com/v1
        kind: ServiceMonitor
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: ocm-config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
        spec:
          endpoints:
          - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
            interval: 30s
            port: metrics
            scheme: https
            tlsConfig:
              ca: {}
              caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
              cert: {}
              serverName: config-policy-controller-metrics.open-cluster-management-agent-addon.svc
          namespaceSelector:
            matchNames:
            - open-cluster-management-agent-addon
          selector:
            matchLabels:
              app: config-policy-controller
              release: config-policy-controller
      - apiVersion: v1
        kind: Service
        metadata:
          annotations:
            service.alpha.openshift.io/serving-cert-secret-name: config-policy-controller-metrics
            service.beta.openshift.io/serving-cert-secret-name: config-policy-controller-metrics
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
        spec:
          ports:
          - name: metrics
            port: 8443
            protocol: TCP
            targetPort: 8443
          selector:
            app: config-policy-controller
            release: config-policy-controller
          sessionAffinity: None
          type: ClusterIP
        status:
          loadBalancer: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: config-policy-controller-metrics
        subjects:
        - kind: ServiceAccount
          name: prometheus-k8s
          namespace: openshift-monitoring
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: config-policy-controller
            chart: config-policy-controller-2.2.0
            heritage: Helm
            release: config-policy-controller
          name: config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - ""
          resources:
          - services
          - pods
          - endpoints
          verbs:
          - get
          - list
          - watch
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:43Z"
      message: Apply manifest work complete
      observedGeneration: 2
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:44Z"
      message: All resources are available
      observedGeneration: 2
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: configurationpolicies.policy.open-cluster-management.io
          namespace: ""
          ordinal: 0
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: operatorpolicies.policy.open-cluster-management.io
          namespace: ""
          ordinal: 1
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: config-policy-controller
          namespace: open-cluster-management-agent-addon
          ordinal: 2
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: config-policy-controller-leader
          namespace: open-cluster-management-agent-addon
          ordinal: 3
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:config-policy-controller
          namespace: ""
          ordinal: 4
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: config-policy-controller-leader
          namespace: open-cluster-management-agent-addon
          ordinal: 5
          resource: roles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:config-policy-controller
          namespace: ""
          ordinal: 6
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: config-policy-controller-sa
          namespace: open-cluster-management-agent-addon
          ordinal: 7
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: open-cluster-management-agent-addon
          namespace: ""
          ordinal: 8
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: monitoring.coreos.com
          kind: ServiceMonitor
          name: ocm-config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 9
          resource: servicemonitors
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Service
          name: config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 10
          resource: services
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 11
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:59:12Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: config-policy-controller-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 12
          resource: roles
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    creationTimestamp: "2024-10-30T03:58:42Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 2
    labels:
      open-cluster-management.io/addon-name: governance-policy-framework
    name: addon-governance-policy-framework-deploy-0
    namespace: vm02980
    ownerReferences:
    - apiVersion: addon.open-cluster-management.io/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedClusterAddOn
      name: governance-policy-framework
      uid: 776de4f8-013e-4081-ba32-f02d72e00cb0
    resourceVersion: "6034862"
    uid: 50529371-b8d9-4102-b7e7-e4a900bb6cef
  spec:
    deleteOption:
      propagationPolicy: SelectivelyOrphan
      selectivelyOrphans:
        orphaningRules:
        - group: ""
          name: open-cluster-management-agent-addon
          namespace: ""
          resource: namespaces
    workload:
      manifests:
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.16.3
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
          name: policies.policy.open-cluster-management.io
        spec:
          group: policy.open-cluster-management.io
          names:
            kind: Policy
            listKind: PolicyList
            plural: policies
            shortNames:
            - plc
            singular: policy
          scope: Namespaced
          versions:
          - additionalPrinterColumns:
            - jsonPath: .spec.remediationAction
              name: Remediation action
              type: string
            - jsonPath: .status.compliant
              name: Compliance state
              type: string
            - jsonPath: .metadata.creationTimestamp
              name: Age
              type: date
            name: v1
            schema:
              openAPIV3Schema:
                description: Policy is the schema for the policies API. Policy wraps
                  other policy engine resources in its "policy-templates" array in
                  order to deliver the resources to managed clusters.
                properties:
                  apiVersion:
                    description: 'APIVersion defines the versioned schema of this
                      representation of an object. Servers should convert recognized
                      schemas to the latest internal value, and may reject unrecognized
                      values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                    type: string
                  kind:
                    description: 'Kind is a string value representing the REST resource
                      this object represents. Servers may infer this from the endpoint
                      the client submits requests to. Cannot be updated. In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                    type: string
                  metadata:
                    type: object
                  spec:
                    description: PolicySpec defines the configurations of the policy
                      engine resources to deliver to the managed clusters.
                    properties:
                      copyPolicyMetadata:
                        description: CopyPolicyMetadata specifies whether the labels
                          and annotations of a policy should be copied when replicating
                          the policy to a managed cluster. If set to "true", all of
                          the labels and annotations of the policy are copied to the
                          replicated policy. If set to "false", only the policy framework-specific
                          policy labels and annotations are copied to the replicated
                          policy. This setting is useful if there is tracking for
                          metadata that should only exist on the root policy. It is
                          recommended to set this to "false" when using Argo CD to
                          deploy the policy definition since Argo CD uses metadata
                          for tracking that should not be replicated. The default
                          value is "true".
                        type: boolean
                      dependencies:
                        description: PolicyDependencies is a list of dependency objects
                          detailed with extra considerations for compliance that should
                          be fulfilled before applying the policies to the managed
                          clusters.
                        items:
                          description: Each PolicyDependency defines an object reference
                            which must be in a certain compliance state before the
                            policy should be created.
                          oneOf:
                          - properties:
                              kind:
                                enum:
                                - CertificatePolicy
                                - ConfigurationPolicy
                              namespace:
                                maxLength: 0
                          - not:
                              properties:
                                kind:
                                  pattern: ^(?:(?:Certificate|Configuration)Policy)$
                          properties:
                            apiVersion:
                              description: 'APIVersion defines the versioned schema
                                of this representation of an object. Servers should
                                convert recognized schemas to the latest internal
                                value, and may reject unrecognized values. More info:
                                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                              type: string
                            compliance:
                              description: Compliance is the required ComplianceState
                                of the object that the policy depends on, at the following
                                path, .status.compliant.
                              enum:
                              - Compliant
                              - Pending
                              - NonCompliant
                              type: string
                            kind:
                              description: 'Kind is a string value representing the
                                REST resource this object represents. Servers may
                                infer this from the endpoint the client submits requests
                                to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                              type: string
                            name:
                              description: Name is the name of the object that the
                                policy depends on.
                              type: string
                            namespace:
                              description: Namespace is the namespace of the object
                                that the policy depends on (optional).
                              type: string
                          required:
                          - compliance
                          - name
                          type: object
                        type: array
                      disabled:
                        description: Disabled is a boolean parameter you can use to
                          enable and disable the policy. When disabled, the policy
                          is removed from managed clusters.
                        type: boolean
                      hubTemplateOptions:
                        description: HubTemplateOptions changes the default behavior
                          of hub templates.
                        properties:
                          serviceAccountName:
                            description: ServiceAccountName is the name of a service
                              account in the same namespace as the policy to use for
                              all hub template lookups. The service account must have
                              list and watch permissions on any object the hub templates
                              look up. If not specified, lookups are restricted to
                              namespaced objects in the same namespace as the policy
                              and to the `ManagedCluster` object associated with the
                              propagated policy.
                            type: string
                        type: object
                      policy-templates:
                        description: PolicyTemplates is a list of definitions of policy
                          engine resources to apply to managed clusters along with
                          configurations on how it should be applied.
                        items:
                          description: PolicyTemplate is the definition of the policy
                            engine resource to apply to the managed cluster, along
                            with configurations on how it should be applied.
                          properties:
                            extraDependencies:
                              description: ExtraDependencies is additional PolicyDependencies
                                that only apply to this policy template. ExtraDependencies
                                is a list of dependency objects detailed with extra
                                considerations for compliance that should be fulfilled
                                before applying the policy template to the managed
                                clusters.
                              items:
                                description: Each PolicyDependency defines an object
                                  reference which must be in a certain compliance
                                  state before the policy should be created.
                                oneOf:
                                - properties:
                                    kind:
                                      enum:
                                      - CertificatePolicy
                                      - ConfigurationPolicy
                                    namespace:
                                      maxLength: 0
                                - not:
                                    properties:
                                      kind:
                                        pattern: ^(?:(?:Certificate|Configuration)Policy)$
                                properties:
                                  apiVersion:
                                    description: 'APIVersion defines the versioned
                                      schema of this representation of an object.
                                      Servers should convert recognized schemas to
                                      the latest internal value, and may reject unrecognized
                                      values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
                                    type: string
                                  compliance:
                                    description: Compliance is the required ComplianceState
                                      of the object that the policy depends on, at
                                      the following path, .status.compliant.
                                    enum:
                                    - Compliant
                                    - Pending
                                    - NonCompliant
                                    type: string
                                  kind:
                                    description: 'Kind is a string value representing
                                      the REST resource this object represents. Servers
                                      may infer this from the endpoint the client
                                      submits requests to. Cannot be updated. In CamelCase.
                                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                                    type: string
                                  name:
                                    description: Name is the name of the object that
                                      the policy depends on.
                                    type: string
                                  namespace:
                                    description: Namespace is the namespace of the
                                      object that the policy depends on (optional).
                                    type: string
                                required:
                                - compliance
                                - name
                                type: object
                              type: array
                            ignorePending:
                              description: IgnorePending is a boolean parameter to
                                specify whether to ignore the "Pending" status of
                                this template when calculating the overall policy
                                status. The default value is "false" to not ignore
                                a "Pending" status.
                              type: boolean
                            objectDefinition:
                              description: A Kubernetes object defining the policy
                                to apply to a managed cluster
                              type: object
                              x-kubernetes-preserve-unknown-fields: true
                          required:
                          - objectDefinition
                          type: object
                        type: array
                      remediationAction:
                        description: 'RemediationAction specifies the remediation
                          of the policy. The parameter values are "enforce" and "inform".
                          If specified, the value that is defined overrides any remediationAction
                          parameter defined in the child policies in the "policy-templates"
                          section. Important: Not all policy engine kinds support
                          the enforce feature.'
                        enum:
                        - Inform
                        - inform
                        - Enforce
                        - enforce
                        type: string
                    required:
                    - disabled
                    - policy-templates
                    type: object
                  status:
                    description: PolicyStatus reports the observed status of the policy
                      resulting from its policy templates.
                    properties:
                      compliant:
                        description: ComplianceState reports the observed status resulting
                          from the definitions of this policy. This status field is
                          only used in the replicated policy in the managed cluster
                          namespace.
                        enum:
                        - Compliant
                        - Pending
                        - NonCompliant
                        type: string
                      details:
                        description: Details is the list of compliance details for
                          each policy template definition. This status field is only
                          used in the replicated policy in the managed cluster namespace.
                        items:
                          description: DetailsPerTemplate reports the current compliance
                            state and list of recent compliance messages for a given
                            policy template.
                          properties:
                            compliant:
                              description: ComplianceState reports the observed status
                                resulting from the definitions of the policy.
                              enum:
                              - Compliant
                              - Pending
                              - NonCompliant
                              type: string
                            history:
                              items:
                                description: ComplianceHistory reports a compliance
                                  message from a given time and event.
                                properties:
                                  eventName:
                                    description: EventName is the name of the event
                                      attached to the message.
                                    type: string
                                  lastTimestamp:
                                    description: LastTimestamp is the timestamp of
                                      the event that reported the message.
                                    format: date-time
                                    type: string
                                  message:
                                    description: Message is the compliance message
                                      resulting from evaluating the policy resource.
                                    type: string
                                type: object
                              type: array
                            templateMeta:
                              type: object
                              x-kubernetes-preserve-unknown-fields: true
                          type: object
                        type: array
                      placement:
                        description: Placement is a list of managed cluster placement
                          resources bound to the policy. This status field is only
                          used in the root policy on the hub cluster.
                        items:
                          description: Placement reports how and what managed cluster
                            placement resources are attached to the policy.
                          properties:
                            decisions:
                              description: Decisions is the list of managed clusters
                                returned by the placement resource for this binding.
                              items:
                                description: PlacementDecision is the cluster name
                                  returned by the placement resource.
                                properties:
                                  clusterName:
                                    type: string
                                  clusterNamespace:
                                    type: string
                                type: object
                              type: array
                            placement:
                              description: Placement is the name of the Placement
                                resource, from the cluster.open-cluster-management.io
                                API group, that is bound to the policy.
                              type: string
                            placementBinding:
                              description: PlacementBinding is the name of the PlacementBinding
                                resource, from the policies.open-cluster-management.io
                                API group, that binds the placement resource to the
                                policy.
                              type: string
                            placementRule:
                              description: PlacementRule (deprecated) is the name
                                of the PlacementRule resource, from the apps.open-cluster-management.io
                                API group, that is bound to the policy.
                              type: string
                            policySet:
                              description: PolicySet is the name of the policy set
                                containing this policy and bound to the placement.
                                If specified, then for this placement the policy is
                                being propagated through this policy set rather than
                                the policy being bound directly to a placement and
                                propagated individually.
                              type: string
                          type: object
                        type: array
                      status:
                        description: Status is a list of managed clusters and the
                          current compliance state of each one. This status field
                          is only used in the root policy on the hub cluster.
                        items:
                          description: CompliancePerClusterStatus reports the name
                            of a managed cluster and its compliance state for this
                            policy.
                          properties:
                            clustername:
                              type: string
                            clusternamespace:
                              type: string
                            compliant:
                              description: ComplianceState reports the observed status
                                resulting from the definitions of the policy.
                              enum:
                              - Compliant
                              - Pending
                              - NonCompliant
                              type: string
                          type: object
                        type: array
                    type: object
                required:
                - metadata
                - spec
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          annotations:
            policy.open-cluster-management.io/uninstalling: "false"
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: governance-policy-framework
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          selector:
            matchLabels:
              app: governance-policy-framework
              release: governance-policy-framework
          strategy:
            type: Recreate
          template:
            metadata:
              annotations:
                kubectl.kubernetes.io/default-container: governance-policy-framework-addon
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              labels:
                app: governance-policy-framework
                chart: governance-policy-framework-2.2.0
                heritage: Helm
                release: governance-policy-framework
            spec:
              affinity: {}
              containers:
              - args:
                - --enable-lease=true
                - --hub-cluster-configfile=/var/run/klusterlet/kubeconfig
                - --leader-elect=false
                - --log-encoder=console
                - --log-level=0
                - --v=-1
                - --evaluation-concurrency=2
                - --client-max-qps=30
                - --client-burst=45
                - --cluster-namespace=vm02980
                - --secure-metrics=true
                - --metrics-bind-address=0.0.0.0:8443
                command:
                - governance-policy-framework-addon
                env:
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: OPERATOR_NAME
                  value: governance-policy-framework-addon
                - name: DEPLOYMENT_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.labels['app']
                - name: HTTP_PROXY
                - name: HTTPS_PROXY
                - name: NO_PROXY
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/acm-governance-policy-framework-addon-rhel9@sha256:2d016601aedf9baa2f070cd5e06c626b0fb0b92695ee26d26877b2f8bf33276c
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /healthz
                    port: 8080
                  periodSeconds: 10
                name: governance-policy-framework-addon
                ports:
                - containerPort: 8443
                  name: metrics
                  protocol: TCP
                readinessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /readyz
                    port: 8080
                  periodSeconds: 10
                resources:
                  limits:
                    memory: 512Mi
                  requests:
                    memory: 64Mi
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                startupProbe:
                  failureThreshold: 30
                  httpGet:
                    path: /readyz
                    port: 8080
                  periodSeconds: 10
                volumeMounts:
                - mountPath: /var/run/metrics-cert
                  name: metrics-cert
                  readOnly: true
                - mountPath: /var/run/klusterlet
                  name: klusterlet-config
              imagePullSecrets:
              - name: open-cluster-management-image-pull-credentials
              securityContext:
                runAsNonRoot: true
              serviceAccountName: governance-policy-framework-sa
              tolerations:
              - effect: NoSchedule
                key: dedicated
                operator: Equal
                value: infra
              - effect: NoSchedule
                key: node-role.kubernetes.io/infra
                operator: Exists
              volumes:
              - name: klusterlet-config
                secret:
                  secretName: governance-policy-framework-hub-kubeconfig
              - name: metrics-cert
                secret:
                  secretName: governance-policy-framework-metrics
        status: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: open-cluster-management:governance-policy-framework
        rules:
        - apiGroups:
          - admissionregistration.k8s.io
          resourceNames:
          - gatekeeper-validating-webhook-configuration
          resources:
          - validatingwebhookconfigurations
          verbs:
          - get
          - list
          - watch
        - apiGroups:
          - apiextensions.k8s.io
          resources:
          - customresourcedefinitions
          verbs:
          - list
          - watch
        - apiGroups:
          - cluster.open-cluster-management.io
          resourceNames:
          - id.k8s.io
          resources:
          - clusterclaims
          verbs:
          - get
        - apiGroups:
          - constraints.gatekeeper.sh
          resources:
          - '*'
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - templates.gatekeeper.sh
          resources:
          - constrainttemplates
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - apps
          resourceNames:
          - governance-policy-framework
          resources:
          - deployments
          verbs:
          - get
          - list
          - patch
          - update
          - watch
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: open-cluster-management:governance-policy-framework
          namespace: vm02980
        rules:
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - ""
          resources:
          - secrets
          verbs:
          - create
        - apiGroups:
          - ""
          resourceNames:
          - policy-encryption-key
          resources:
          - secrets
          verbs:
          - delete
          - get
          - list
          - update
          - watch
        - apiGroups:
          - policy.open-cluster-management.io
          resources:
          - '*'
          verbs:
          - create
          - delete
          - get
          - list
          - patch
          - update
          - watch
        - apiGroups:
          - policy.open-cluster-management.io
          resources:
          - policies
          verbs:
          - deletecollection
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: ocm:open-cluster-management-agent-addon:governance-policy-framework-0
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:governance-policy-framework
        subjects:
        - kind: ServiceAccount
          name: governance-policy-framework-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: open-cluster-management:governance-policy-framework
          namespace: vm02980
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: open-cluster-management:governance-policy-framework
        subjects:
        - kind: ServiceAccount
          name: governance-policy-framework-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: governance-policy-framework-leader
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: governance-policy-framework-leader
        subjects:
        - kind: ServiceAccount
          name: governance-policy-framework-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: governance-policy-framework-leader
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - get
          - list
          - watch
          - create
          - update
          - patch
          - delete
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
          - patch
      - apiVersion: v1
        imagePullSecrets:
        - name: open-cluster-management-image-pull-credentials
        kind: ServiceAccount
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: governance-policy-framework-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: v1
        kind: Namespace
        metadata:
          annotations:
            addon.open-cluster-management.io/deletion-orphan: ""
          labels:
            openshift.io/cluster-monitoring: "true"
          name: open-cluster-management-agent-addon
        spec: {}
        status: {}
      - apiVersion: v1
        kind: Namespace
        metadata:
          name: open-cluster-management-policies
        spec: {}
        status: {}
      - apiVersion: v1
        kind: Namespace
        metadata:
          name: vm02980
        spec: {}
        status: {}
      - apiVersion: monitoring.coreos.com/v1
        kind: ServiceMonitor
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: ocm-governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
        spec:
          endpoints:
          - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
            interval: 30s
            port: metrics
            scheme: https
            tlsConfig:
              ca: {}
              caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
              cert: {}
              serverName: governance-policy-framework-metrics.open-cluster-management-agent-addon.svc
          namespaceSelector:
            matchNames:
            - open-cluster-management-agent-addon
          selector:
            matchLabels:
              app: governance-policy-framework
              release: governance-policy-framework
      - apiVersion: v1
        kind: Service
        metadata:
          annotations:
            service.alpha.openshift.io/serving-cert-secret-name: governance-policy-framework-metrics
            service.beta.openshift.io/serving-cert-secret-name: governance-policy-framework-metrics
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
        spec:
          ports:
          - name: metrics
            port: 8443
            protocol: TCP
            targetPort: 8443
          selector:
            app: governance-policy-framework
            release: governance-policy-framework
          sessionAffinity: None
          type: ClusterIP
        status:
          loadBalancer: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: open-cluster-management:governance-policy-framework-auth
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:governance-policy-framework-auth
        subjects:
        - kind: ServiceAccount
          name: governance-policy-framework-sa
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: governance-policy-framework-metrics
        subjects:
        - kind: ServiceAccount
          name: prometheus-k8s
          namespace: openshift-monitoring
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: open-cluster-management:governance-policy-framework-auth
        rules:
        - apiGroups:
          - authentication.k8s.io
          resources:
          - tokenreviews
          verbs:
          - create
        - apiGroups:
          - authorization.k8s.io
          resources:
          - subjectaccessreviews
          verbs:
          - create
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            app: governance-policy-framework
            chart: governance-policy-framework-2.2.0
            heritage: Helm
            release: governance-policy-framework
          name: governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - ""
          resources:
          - services
          - pods
          - endpoints
          - nodes
          - secrets
          verbs:
          - get
          - list
          - watch
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:45Z"
      message: Apply manifest work complete
      observedGeneration: 2
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:46Z"
      message: All resources are available
      observedGeneration: 2
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: policies.policy.open-cluster-management.io
          namespace: ""
          ordinal: 0
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: governance-policy-framework
          namespace: open-cluster-management-agent-addon
          ordinal: 1
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:governance-policy-framework
          namespace: ""
          ordinal: 2
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: open-cluster-management:governance-policy-framework
          namespace: vm02980
          ordinal: 3
          resource: roles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: ocm:open-cluster-management-agent-addon:governance-policy-framework-0
          namespace: ""
          ordinal: 4
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:46Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:46Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: open-cluster-management:governance-policy-framework
          namespace: vm02980
          ordinal: 5
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: governance-policy-framework-leader
          namespace: open-cluster-management-agent-addon
          ordinal: 6
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: governance-policy-framework-leader
          namespace: open-cluster-management-agent-addon
          ordinal: 7
          resource: roles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: governance-policy-framework-sa
          namespace: open-cluster-management-agent-addon
          ordinal: 8
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: open-cluster-management-agent-addon
          namespace: ""
          ordinal: 9
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: open-cluster-management-policies
          namespace: ""
          ordinal: 10
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: vm02980
          namespace: ""
          ordinal: 11
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:49Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: monitoring.coreos.com
          kind: ServiceMonitor
          name: ocm-governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 12
          resource: servicemonitors
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:49Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Service
          name: governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 13
          resource: services
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:49Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:governance-policy-framework-auth
          namespace: ""
          ordinal: 14
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:49Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 15
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:49Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:governance-policy-framework-auth
          namespace: ""
          ordinal: 16
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:49Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:50Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: governance-policy-framework-metrics
          namespace: open-cluster-management-agent-addon
          ordinal: 17
          resource: roles
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    annotations:
      open-cluster-management.io/config-spec-hash: '{"addontemplates.addon.open-cluster-management.io//managed-serviceaccount-2.7":"5bd4959a2bd48122df6ebea849747061033e9a51cce4bac12eca849ee443a7aa"}'
    creationTimestamp: "2024-10-30T02:44:07Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 1
    labels:
      open-cluster-management.io/addon-name: managed-serviceaccount
    name: addon-managed-serviceaccount-deploy-0
    namespace: vm02980
    ownerReferences:
    - apiVersion: addon.open-cluster-management.io/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedClusterAddOn
      name: managed-serviceaccount
      uid: a4a8b3d3-3263-4712-85fa-3f7815ca3aa7
    resourceVersion: "6044828"
    uid: 396b7399-4832-458f-b123-16efe8bcaa3b
  spec:
    deleteOption:
      propagationPolicy: SelectivelyOrphan
      selectivelyOrphans:
        orphaningRules:
        - group: ""
          name: open-cluster-management-agent-addon
          namespace: ""
          resource: namespaces
    manifestConfigs:
    - feedbackRules:
      - type: WellKnownStatus
      resourceIdentifier:
        group: apps
        name: managed-serviceaccount-addon-agent
        namespace: open-cluster-management-agent-addon
        resource: deployments
    workload:
      manifests:
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: managed-serviceaccount-addon-agent
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          selector:
            matchLabels:
              addon-agent: managed-serviceaccount
          strategy: {}
          template:
            metadata:
              annotations:
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              creationTimestamp: null
              labels:
                addon-agent: managed-serviceaccount
            spec:
              containers:
              - args:
                - --cluster-name=vm02980
                - --kubeconfig=/managed/hub-kubeconfig/kubeconfig
                - --feature-gates=EphemeralIdentity=true
                command:
                - /agent
                env:
                - name: HUB_KUBECONFIG
                  value: /managed/hub-kubeconfig/kubeconfig
                - name: CLUSTER_NAME
                  value: vm02980
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/managed-serviceaccount-rhel9@sha256:b55f67c310e5511ecea03f7a3e2b7e030e3f972229828cf50cf2664c6dcdbbb7
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  httpGet:
                    path: /healthz
                    port: 8000
                  initialDelaySeconds: 2
                  periodSeconds: 10
                name: addon-agent
                resources: {}
                volumeMounts:
                - mountPath: /managed/hub-kubeconfig
                  name: hub-kubeconfig
              serviceAccount: managed-serviceaccount
              volumes:
              - name: hub-kubeconfig
                secret:
                  secretName: managed-serviceaccount-hub-kubeconfig
        status: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - ""
          resources:
          - events
          verbs:
          - create
        - apiGroups:
          - ""
          resources:
          - serviceaccounts
          - serviceaccounts/token
          verbs:
          - get
          - watch
          - list
          - create
          - delete
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - get
          - create
          - update
          - patch
        - apiGroups:
          - authentication.k8s.io
          resources:
          - tokenrequests
          verbs:
          - get
          - create
          - update
          - patch
        - apiGroups:
          - ""
          resources:
          - secrets
          verbs:
          - get
          - list
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: open-cluster-management:managed-serviceaccount:addon-agent
        subjects:
        - kind: ServiceAccount
          name: managed-serviceaccount
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:managed-serviceaccount:addon-agent
        subjects:
        - kind: ServiceAccount
          name: managed-serviceaccount
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          name: open-cluster-management:managed-serviceaccount:addon-agent
        rules:
        - apiGroups:
          - authentication.k8s.io
          resources:
          - tokenreviews
          verbs:
          - create
      - apiVersion: v1
        kind: Namespace
        metadata:
          annotations:
            addon.open-cluster-management.io/deletion-orphan: ""
          labels:
            addon.open-cluster-management.io/namespace: "true"
          name: open-cluster-management-agent-addon
      - apiVersion: v1
        imagePullSecrets:
        - name: open-cluster-management-image-pull-credentials
        kind: ServiceAccount
        metadata:
          name: managed-serviceaccount
          namespace: open-cluster-management-agent-addon
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:42Z"
      message: Apply manifest work complete
      observedGeneration: 1
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:42Z"
      message: All resources are available
      observedGeneration: 1
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: StatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: managed-serviceaccount-addon-agent
          namespace: open-cluster-management-agent-addon
          ordinal: 0
          resource: deployments
          version: v1
        statusFeedback:
          values:
          - fieldValue:
              integer: 1
              type: Integer
            name: ReadyReplicas
          - fieldValue:
              integer: 1
              type: Integer
            name: Replicas
          - fieldValue:
              integer: 1
              type: Integer
            name: AvailableReplicas
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: open-cluster-management-agent-addon
          ordinal: 1
          resource: roles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: open-cluster-management-agent-addon
          ordinal: 2
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: ""
          ordinal: 3
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:managed-serviceaccount:addon-agent
          namespace: ""
          ordinal: 4
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: open-cluster-management-agent-addon
          namespace: ""
          ordinal: 5
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:42Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: managed-serviceaccount
          namespace: open-cluster-management-agent-addon
          ordinal: 6
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    creationTimestamp: "2024-10-30T02:44:04Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 1
    labels:
      open-cluster-management.io/addon-name: work-manager
    name: addon-work-manager-deploy-0
    namespace: vm02980
    ownerReferences:
    - apiVersion: addon.open-cluster-management.io/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedClusterAddOn
      name: work-manager
      uid: 19162b5c-0dfd-4aaf-a708-33ab11bbfdb6
    resourceVersion: "6033215"
    uid: 007fcc49-4d1a-4ad3-b52b-da96fa1ec16c
  spec:
    workload:
      manifests:
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            component: work-manager
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
        spec:
          replicas: 1
          revisionHistoryLimit: 2
          selector:
            matchLabels:
              component: work-manager
          strategy: {}
          template:
            metadata:
              annotations:
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              creationTimestamp: null
              labels:
                component: work-manager
            spec:
              containers:
              - args:
                - /agent
                - --port=4443
                - --agent-port=443
                - --hub-kubeconfig=/var/run/klusterlet/kubeconfig
                - --cluster-name=vm02980
                - --agent-name=klusterlet-addon-workmgr
                env:
                - name: POD_NAMESPACE
                  valueFrom:
                    fieldRef:
                      apiVersion: v1
                      fieldPath: metadata.namespace
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/multicloud-manager-rhel9@sha256:e877c49f0055d0412cf464d790c3840847bf7daa6307410b1620ca3dbcbcfebb
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /healthz
                    port: 8000
                  periodSeconds: 10
                name: acm-agent
                readinessProbe:
                  failureThreshold: 3
                  httpGet:
                    path: /readyz
                    port: 8000
                  periodSeconds: 10
                resources:
                  limits:
                    memory: 512Mi
                  requests:
                    memory: 128Mi
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                  runAsNonRoot: true
                volumeMounts:
                - mountPath: /tmp
                  name: tmp
                - mountPath: /var/run/klusterlet
                  name: klusterlet-config
              imagePullSecrets:
              - name: open-cluster-management-image-pull-credentials
              securityContext:
                seccompProfile:
                  type: RuntimeDefault
              serviceAccountName: klusterlet-addon-workmgr
              tolerations:
              - effect: NoSchedule
                key: dedicated
                operator: Equal
                value: infra
              - effect: NoSchedule
                key: node-role.kubernetes.io/infra
                operator: Exists
              volumes:
              - emptyDir: {}
                name: tmp
              - name: klusterlet-config
                secret:
                  secretName: work-manager-hub-kubeconfig
        status: {}
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            component: work-manager
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
        rules:
        - apiGroups:
          - ""
          resources:
          - services
          verbs:
          - get
          - create
          - delete
          - update
        - apiGroups:
          - ""
          resources:
          - configmaps
          verbs:
          - get
          - list
          - watch
          - create
          - delete
          - update
          - patch
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
        - apiGroups:
          - ""
          - events.k8s.io
          resources:
          - events
          verbs:
          - create
          - patch
          - update
        - apiGroups:
          - route.openshift.io
          resources:
          - routes
          - routes/custom-host
          verbs:
          - get
          - list
          - watch
          - update
          - create
          - delete
        - apiGroups:
          - config.openshift.io
          resources:
          - ingresses
          verbs:
          - get
        - apiGroups:
          - apps
          resources:
          - deployments
          - deployments/finalizers
          verbs:
          - get
          - create
          - update
          - delete
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: none
            component: work-manager
          name: open-cluster-management:klusterlet-addon-workmgr-log
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:klusterlet-addon-workmgr-log
        subjects:
        - kind: ServiceAccount
          name: klusterlet-addon-workmgr-log
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: none
            component: work-manager
          name: open-cluster-management:klusterlet-addon-workmgr
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:klusterlet-addon-workmgr
        subjects:
        - kind: ServiceAccount
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            component: work-manager
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: klusterlet-addon-workmgr
        subjects:
        - kind: ServiceAccount
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: none
            component: work-manager
          name: open-cluster-management:klusterlet-addon-workmgr
        rules:
        - apiGroups:
          - '*'
          resources:
          - '*'
          verbs:
          - '*'
        - nonResourceURLs:
          - '*'
          verbs:
          - '*'
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: none
            component: work-manager
          name: open-cluster-management:klusterlet-addon-workmgr-log
        rules:
        - apiGroups:
          - ""
          resources:
          - pods
          - pods/log
          verbs:
          - get
      - apiVersion: v1
        kind: ServiceAccount
        metadata:
          labels:
            addon.open-cluster-management.io/hosted-manifest-location: hosting
            component: work-manager
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:43Z"
      message: Apply manifest work complete
      observedGeneration: 1
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:43Z"
      message: All resources are available
      observedGeneration: 1
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
          ordinal: 0
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: Role
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
          ordinal: 1
          resource: roles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:klusterlet-addon-workmgr-log
          namespace: ""
          ordinal: 2
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:klusterlet-addon-workmgr
          namespace: ""
          ordinal: 3
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: RoleBinding
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
          ordinal: 4
          resource: rolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:klusterlet-addon-workmgr
          namespace: ""
          ordinal: 5
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:klusterlet-addon-workmgr-log
          namespace: ""
          ordinal: 6
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:43Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: klusterlet-addon-workmgr
          namespace: open-cluster-management-agent-addon
          ordinal: 7
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    creationTimestamp: "2024-10-30T03:58:16Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 2
    labels:
      import.open-cluster-management.io/klusterlet-works: "true"
    name: vm02980-klusterlet
    namespace: vm02980
    ownerReferences:
    - apiVersion: cluster.open-cluster-management.io/v1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedCluster
      name: vm02980
      uid: 083951a3-3647-46fb-b224-41fc9cd5125c
    resourceVersion: "6283952"
    uid: ae1469f1-3a86-4723-8fa5-4a973c2a9591
  spec:
    deleteOption:
      propagationPolicy: Orphan
    workload:
      manifests:
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            open-cluster-management.io/aggregate-to-work: "true"
          name: klusterlet-priority-class
        rules:
        - apiGroups:
          - scheduling.k8s.io
          resources:
          - priorityclasses
          verbs:
          - get
          - create
          - patch
          - update
          - delete
      - apiVersion: scheduling.k8s.io/v1
        description: This priority class should be used for klusterlet agents only.
        globalDefault: false
        kind: PriorityClass
        metadata:
          name: klusterlet-critical
        preemptionPolicy: PreemptLowerPriority
        value: 1000000
      - apiVersion: v1
        kind: Namespace
        metadata:
          annotations:
            workload.openshift.io/allowed: management
          name: open-cluster-management-agent
      - apiVersion: v1
        imagePullSecrets:
        - name: open-cluster-management-image-pull-credentials
        kind: ServiceAccount
        metadata:
          name: klusterlet
          namespace: open-cluster-management-agent
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          name: klusterlet
        rules:
        - apiGroups:
          - ""
          resources:
          - secrets
          - configmaps
          - serviceaccounts
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
          - delete
        - apiGroups:
          - ""
          resources:
          - pods
          verbs:
          - get
        - apiGroups:
          - apps
          resources:
          - replicasets
          verbs:
          - get
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
        - apiGroups:
          - authorization.k8s.io
          resources:
          - subjectaccessreviews
          verbs:
          - create
        - apiGroups:
          - ""
          resources:
          - namespaces
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
          - delete
        - apiGroups:
          - ""
          resources:
          - nodes
          verbs:
          - get
          - list
          - watch
        - apiGroups:
          - ""
          - events.k8s.io
          resources:
          - events
          verbs:
          - create
          - patch
          - update
        - apiGroups:
          - apps
          resources:
          - deployments
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
          - delete
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - clusterrolebindings
          - rolebindings
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
          - delete
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - clusterroles
          - roles
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
          - delete
          - escalate
          - bind
        - apiGroups:
          - apiextensions.k8s.io
          resources:
          - customresourcedefinitions
          verbs:
          - create
          - get
          - list
          - update
          - watch
          - patch
          - delete
        - apiGroups:
          - operator.open-cluster-management.io
          resources:
          - klusterlets
          verbs:
          - get
          - list
          - watch
          - update
          - patch
          - delete
        - apiGroups:
          - operator.open-cluster-management.io
          resources:
          - klusterlets/status
          verbs:
          - update
          - patch
        - apiGroups:
          - work.open-cluster-management.io
          resources:
          - appliedmanifestworks
          verbs:
          - list
          - update
          - patch
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          name: klusterlet-bootstrap-kubeconfig
        rules:
        - apiGroups:
          - ""
          resourceNames:
          - bootstrap-hub-kubeconfig
          resources:
          - secrets
          verbs:
          - get
          - update
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            rbac.authorization.k8s.io/aggregate-to-admin: "true"
          name: open-cluster-management:klusterlet-admin-aggregate-clusterrole
        rules:
        - apiGroups:
          - operator.open-cluster-management.io
          resources:
          - klusterlets
          verbs:
          - get
          - list
          - watch
          - create
          - update
          - patch
          - delete
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          name: klusterlet
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: klusterlet
        subjects:
        - kind: ServiceAccount
          name: klusterlet
          namespace: open-cluster-management-agent
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          labels:
            app: klusterlet
          name: klusterlet
          namespace: open-cluster-management-agent
        spec:
          replicas: 1
          selector:
            matchLabels:
              app: klusterlet
          template:
            metadata:
              annotations:
                target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
              labels:
                app: klusterlet
            spec:
              containers:
              - args:
                - /registration-operator
                - klusterlet
                - --disable-leader-election
                env:
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/registration-operator-rhel9@sha256:e4c91e3a4d77b5beb9562206bb016e08d046db45770bcd46a7ab9df1e39d4b80
                imagePullPolicy: IfNotPresent
                livenessProbe:
                  httpGet:
                    path: /healthz
                    port: 8443
                    scheme: HTTPS
                  initialDelaySeconds: 2
                  periodSeconds: 10
                name: klusterlet
                readinessProbe:
                  httpGet:
                    path: /healthz
                    port: 8443
                    scheme: HTTPS
                  initialDelaySeconds: 2
                resources:
                  limits:
                    memory: 2Gi
                  requests:
                    cpu: 50m
                    memory: 64Mi
                securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                    - ALL
                  privileged: false
                  readOnlyRootFilesystem: true
                  runAsNonRoot: true
                volumeMounts:
                - mountPath: /tmp
                  name: tmpdir
              priorityClassName: klusterlet-critical
              securityContext:
                runAsNonRoot: true
              serviceAccountName: klusterlet
              tolerations:
              - effect: NoSchedule
                key: node-role.kubernetes.io/infra
                operator: Exists
              volumes:
              - emptyDir: {}
                name: tmpdir
      - apiVersion: v1
        data:
          kubeconfig: notsecret
        kind: Secret
        metadata:
          name: bootstrap-hub-kubeconfig
          namespace: open-cluster-management-agent
        type: Opaque
      - apiVersion: operator.open-cluster-management.io/v1
        kind: Klusterlet
        metadata:
          name: klusterlet
        spec:
          clusterName: vm02980
          deployOption:
            mode: Singleton
          imagePullSpec: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/registration-operator-rhel9@sha256:e4c91e3a4d77b5beb9562206bb016e08d046db45770bcd46a7ab9df1e39d4b80
          namespace: open-cluster-management-agent
          nodePlacement:
            tolerations:
            - effect: NoSchedule
              key: node-role.kubernetes.io/infra
              operator: Exists
          priorityClassName: klusterlet-critical
          registrationConfiguration:
            bootstrapKubeConfigs:
              localSecretsConfig:
                kubeConfigSecrets: null
          registrationImagePullSpec: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/registration-rhel9@sha256:914796c745bcccacab7b864656d92d3ac92c628b56591694401c42b6e3ee7a05
          workConfiguration: {}
          workImagePullSpec: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/work-rhel9@sha256:18fb1809d8ed6d6320bd7e8b9a8b00731e77e9334464b74a135e72fad2de5ff2
      - apiVersion: v1
        data:
          .dockerconfigjson: e30=
        kind: Secret
        metadata:
          name: open-cluster-management-image-pull-credentials
          namespace: open-cluster-management-agent
        type: kubernetes.io/dockerconfigjson
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:44Z"
      message: Apply manifest work complete
      observedGeneration: 2
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:45Z"
      message: All resources are available
      observedGeneration: 2
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T04:32:25Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:32:25Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:32:25Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: klusterlet-priority-class
          namespace: ""
          ordinal: 0
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:32:25Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:32:25Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:32:25Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: scheduling.k8s.io
          kind: PriorityClass
          name: klusterlet-critical
          namespace: ""
          ordinal: 1
          resource: priorityclasses
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: open-cluster-management-agent
          namespace: ""
          ordinal: 2
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: klusterlet
          namespace: open-cluster-management-agent
          ordinal: 3
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: klusterlet
          namespace: ""
          ordinal: 4
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: klusterlet-bootstrap-kubeconfig
          namespace: ""
          ordinal: 5
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:klusterlet-admin-aggregate-clusterrole
          namespace: ""
          ordinal: 6
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: klusterlet
          namespace: ""
          ordinal: 7
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: klusterlet
          namespace: open-cluster-management-agent
          ordinal: 8
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: bootstrap-hub-kubeconfig
          namespace: open-cluster-management-agent
          ordinal: 9
          resource: secrets
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: operator.open-cluster-management.io
          kind: Klusterlet
          name: klusterlet
          namespace: ""
          ordinal: 10
          resource: klusterlets
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: open-cluster-management-image-pull-credentials
          namespace: open-cluster-management-agent
          ordinal: 11
          resource: secrets
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    creationTimestamp: "2024-10-30T03:58:16Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 1
    labels:
      import.open-cluster-management.io/klusterlet-works: "true"
    name: vm02980-klusterlet-crds
    namespace: vm02980
    ownerReferences:
    - apiVersion: cluster.open-cluster-management.io/v1
      blockOwnerDeletion: true
      controller: true
      kind: ManagedCluster
      name: vm02980
      uid: 083951a3-3647-46fb-b224-41fc9cd5125c
    resourceVersion: "6033590"
    uid: 72839818-10bd-4cca-8caf-678f72941ce6
  spec:
    workload:
      manifests:
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          name: klusterlets.operator.open-cluster-management.io
        spec:
          group: operator.open-cluster-management.io
          names:
            kind: Klusterlet
            listKind: KlusterletList
            plural: klusterlets
            singular: klusterlet
          preserveUnknownFields: false
          scope: Cluster
          versions:
          - name: v1
            schema:
              openAPIV3Schema:
                description: |-
                  Klusterlet represents controllers to install the resources for a managed cluster.
                  When configured, the Klusterlet requires a secret named bootstrap-hub-kubeconfig in the
                  agent namespace to allow API requests to the hub for the registration protocol.
                  In Hosted mode, the Klusterlet requires an additional secret named external-managed-kubeconfig
                  in the agent namespace to allow API requests to the managed cluster for resources installation.
                properties:
                  apiVersion:
                    description: |-
                      APIVersion defines the versioned schema of this representation of an object.
                      Servers should convert recognized schemas to the latest internal value, and
                      may reject unrecognized values.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                    type: string
                  kind:
                    description: |-
                      Kind is a string value representing the REST resource this object represents.
                      Servers may infer this from the endpoint the client submits requests to.
                      Cannot be updated.
                      In CamelCase.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                    type: string
                  metadata:
                    type: object
                  spec:
                    description: Spec represents the desired deployment configuration
                      of Klusterlet agent.
                    properties:
                      clusterName:
                        description: |-
                          ClusterName is the name of the managed cluster to be created on hub.
                          The Klusterlet agent generates a random name if it is not set, or discovers the appropriate cluster name on OpenShift.
                        maxLength: 63
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                        type: string
                      deployOption:
                        description: DeployOption contains the options of deploying
                          a klusterlet
                        properties:
                          mode:
                            description: |-
                              Mode can be Default, Hosted, Singleton or SingletonHosted. It is Default mode if not specified
                              In Default mode, all klusterlet related resources are deployed on the managed cluster.
                              In Hosted mode, only crd and configurations are installed on the spoke/managed cluster. Controllers run in another
                              cluster (defined as management-cluster) and connect to the mangaged cluster with the kubeconfig in secret of
                              "external-managed-kubeconfig"(a kubeconfig of managed-cluster with cluster-admin permission).
                              In Singleton mode, registration/work agent is started as a single deployment.
                              In SingletonHosted mode, agent is started as a single deployment in hosted mode.
                              Note: Do not modify the Mode field once it's applied.
                            type: string
                        type: object
                      externalServerURLs:
                        description: |-
                          ExternalServerURLs represents a list of apiserver urls and ca bundles that is accessible externally
                          If it is set empty, managed cluster has no externally accessible url that hub cluster can visit.
                        items:
                          description: ServerURL represents the apiserver url and
                            ca bundle that is accessible externally
                          properties:
                            caBundle:
                              description: |-
                                CABundle is the ca bundle to connect to apiserver of the managed cluster.
                                System certs are used if it is not set.
                              format: byte
                              type: string
                            url:
                              description: URL is the url of apiserver endpoint of
                                the managed cluster.
                              type: string
                          type: object
                        type: array
                      hubApiServerHostAlias:
                        description: |-
                          HubApiServerHostAlias contains the host alias for hub api server.
                          registration-agent and work-agent will use it to communicate with hub api server.
                        properties:
                          hostname:
                            description: Hostname for the above IP address.
                            pattern: ^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$
                            type: string
                          ip:
                            description: IP address of the host file entry.
                            pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
                            type: string
                        required:
                        - hostname
                        - ip
                        type: object
                      imagePullSpec:
                        description: |-
                          ImagePullSpec represents the desired image configuration of agent, it takes effect only when
                          singleton mode is set. quay.io/open-cluster-management.io/registration-operator:latest will
                          be used if unspecified
                        type: string
                      namespace:
                        description: |-
                          Namespace is the namespace to deploy the agent on the managed cluster.
                          The namespace must have a prefix of "open-cluster-management-", and if it is not set,
                          the namespace of "open-cluster-management-agent" is used to deploy agent.
                          In addition, the add-ons are deployed to the namespace of "{Namespace}-addon".
                          In the Hosted mode, this namespace still exists on the managed cluster to contain
                          necessary resources, like service accounts, roles and rolebindings, while the agent
                          is deployed to the namespace with the same name as klusterlet on the management cluster.
                        maxLength: 57
                        pattern: ^open-cluster-management-[-a-z0-9]*[a-z0-9]$
                        type: string
                      nodePlacement:
                        description: NodePlacement enables explicit control over the
                          scheduling of the deployed pods.
                        properties:
                          nodeSelector:
                            additionalProperties:
                              type: string
                            description: NodeSelector defines which Nodes the Pods
                              are scheduled on. The default is an empty list.
                            type: object
                          tolerations:
                            description: |-
                              Tolerations are attached by pods to tolerate any taint that matches
                              the triple <key,value,effect> using the matching operator <operator>.
                              The default is an empty list.
                            items:
                              description: |-
                                The pod this Toleration is attached to tolerates any taint that matches
                                the triple <key,value,effect> using the matching operator <operator>.
                              properties:
                                effect:
                                  description: |-
                                    Effect indicates the taint effect to match. Empty means match all taint effects.
                                    When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                                  type: string
                                key:
                                  description: |-
                                    Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                    If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                                  type: string
                                operator:
                                  description: |-
                                    Operator represents a key's relationship to the value.
                                    Valid operators are Exists and Equal. Defaults to Equal.
                                    Exists is equivalent to wildcard for value, so that a pod can
                                    tolerate all taints of a particular category.
                                  type: string
                                tolerationSeconds:
                                  description: |-
                                    TolerationSeconds represents the period of time the toleration (which must be
                                    of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                    it is not set, which means tolerate the taint forever (do not evict). Zero and
                                    negative values will be treated as 0 (evict immediately) by the system.
                                  format: int64
                                  type: integer
                                value:
                                  description: |-
                                    Value is the taint value the toleration matches to.
                                    If the operator is Exists, the value should be empty, otherwise just a regular string.
                                  type: string
                              type: object
                            type: array
                        type: object
                      priorityClassName:
                        description: |-
                          PriorityClassName is the name of the PriorityClass that will be used by the
                          deployed klusterlet agent. It will be ignored when the PriorityClass/v1 API
                          is not available on the managed cluster.
                        type: string
                      registrationConfiguration:
                        description: RegistrationConfiguration contains the configuration
                          of registration
                        properties:
                          bootstrapKubeConfigs:
                            description: |-
                              BootstrapKubeConfigs defines the ordered list of bootstrap kubeconfigs. The order decides which bootstrap kubeconfig to use first when rebootstrap.


                              When the agent loses the connection to the current hub over HubConnectionTimeoutSeconds, or the managedcluster CR
                              is set `hubAcceptsClient=false` on the hub, the controller marks the related bootstrap kubeconfig as "failed".


                              A failed bootstrapkubeconfig won't be used for the duration specified by SkipFailedBootstrapKubeConfigSeconds.
                              But if the user updates the content of a failed bootstrapkubeconfig, the "failed" mark will be cleared.
                            properties:
                              localSecretsConfig:
                                description: |-
                                  LocalSecretsConfig include a list of secrets that contains the kubeconfigs for ordered bootstrap kubeconifigs.
                                  The secrets must be in the same namespace where the agent controller runs.
                                properties:
                                  hubConnectionTimeoutSeconds:
                                    default: 600
                                    description: |-
                                      HubConnectionTimeoutSeconds is used to set the timeout of connecting to the hub cluster.
                                      When agent loses the connection to the hub over the timeout seconds, the agent do a rebootstrap.
                                      By default is 10 mins.
                                    format: int32
                                    minimum: 180
                                    type: integer
                                  kubeConfigSecrets:
                                    description: KubeConfigSecrets is a list of secret
                                      names. The secrets are in the same namespace
                                      where the agent controller runs.
                                    items:
                                      properties:
                                        name:
                                          description: Name is the name of the secret.
                                          type: string
                                      type: object
                                    type: array
                                type: object
                              type:
                                default: None
                                description: |-
                                  Type specifies the type of priority bootstrap kubeconfigs.
                                  By default, it is set to None, representing no priority bootstrap kubeconfigs are set.
                                enum:
                                - None
                                - LocalSecrets
                                type: string
                            type: object
                          clientCertExpirationSeconds:
                            description: |-
                              clientCertExpirationSeconds represents the seconds of a client certificate to expire. If it is not set or 0, the default
                              duration seconds will be set by the hub cluster. If the value is larger than the max signing duration seconds set on
                              the hub cluster, the max signing duration seconds will be set.
                            format: int32
                            type: integer
                          clusterAnnotations:
                            additionalProperties:
                              type: string
                            description: |-
                              ClusterAnnotations is annotations with the reserve prefix "agent.open-cluster-management.io" set on
                              ManagedCluster when creating only, other actors can update it afterwards.
                            type: object
                          featureGates:
                            description: "FeatureGates represents the list of feature
                              gates for registration\nIf it is set empty, default
                              feature gates will be used.\nIf it is set, featuregate/Foo
                              is an example of one item in FeatureGates:\n  1. If
                              featuregate/Foo does not exist, registration-operator
                              will discard it\n  2. If featuregate/Foo exists and
                              is false by default. It is now possible to set featuregate/Foo=[false|true]\n
                              \ 3. If featuregate/Foo exists and is true by default.
                              If a cluster-admin upgrading from 1 to 2 wants to continue
                              having featuregate/Foo=false,\n \the can set featuregate/Foo=false
                              before upgrading. Let's say the cluster-admin wants
                              featuregate/Foo=false."
                            items:
                              properties:
                                feature:
                                  description: Feature is the key of feature gate.
                                    e.g. featuregate/Foo.
                                  type: string
                                mode:
                                  default: Disable
                                  description: |-
                                    Mode is either Enable, Disable, "" where "" is Disable by default.
                                    In Enable mode, a valid feature gate `featuregate/Foo` will be set to "--featuregate/Foo=true".
                                    In Disable mode, a valid feature gate `featuregate/Foo` will be set to "--featuregate/Foo=false".
                                  enum:
                                  - Enable
                                  - Disable
                                  type: string
                              required:
                              - feature
                              type: object
                            type: array
                          kubeAPIBurst:
                            default: 100
                            description: |-
                              KubeAPIBurst indicates the maximum burst of the throttle while talking with apiserver of hub cluster from the spoke cluster.
                              If it is set empty, use the default value: 100
                            format: int32
                            type: integer
                          kubeAPIQPS:
                            default: 50
                            description: |-
                              KubeAPIQPS indicates the maximum QPS while talking with apiserver of hub cluster from the spoke cluster.
                              If it is set empty, use the default value: 50
                            format: int32
                            type: integer
                        type: object
                      registrationImagePullSpec:
                        description: |-
                          RegistrationImagePullSpec represents the desired image configuration of registration agent.
                          quay.io/open-cluster-management.io/registration:latest will be used if unspecified.
                        type: string
                      resourceRequirement:
                        description: |-
                          ResourceRequirement specify QoS classes of deployments managed by klusterlet.
                          It applies to all the containers in the deployments.
                        properties:
                          resourceRequirements:
                            description: ResourceRequirements defines resource requests
                              and limits when Type is ResourceQosClassResourceRequirement
                            properties:
                              claims:
                                description: |-
                                  Claims lists the names of resources, defined in spec.resourceClaims,
                                  that are used by this container.


                                  This is an alpha field and requires enabling the
                                  DynamicResourceAllocation feature gate.


                                  This field is immutable. It can only be set for containers.
                                items:
                                  description: ResourceClaim references one entry
                                    in PodSpec.ResourceClaims.
                                  properties:
                                    name:
                                      description: |-
                                        Name must match the name of one entry in pod.spec.resourceClaims of
                                        the Pod where this field is used. It makes that resource available
                                        inside a container.
                                      type: string
                                  required:
                                  - name
                                  type: object
                                type: array
                                x-kubernetes-list-map-keys:
                                - name
                                x-kubernetes-list-type: map
                              limits:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Limits describes the maximum amount of compute resources allowed.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                              requests:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Requests describes the minimum amount of compute resources required.
                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                            type: object
                          type:
                            default: Default
                            enum:
                            - Default
                            - BestEffort
                            - ResourceRequirement
                            type: string
                        type: object
                      workConfiguration:
                        description: WorkConfiguration contains the configuration
                          of work
                        properties:
                          appliedManifestWorkEvictionGracePeriod:
                            description: |-
                              AppliedManifestWorkEvictionGracePeriod is the eviction grace period the work agent will wait before
                              evicting the AppliedManifestWorks, whose corresponding ManifestWorks are missing on the hub cluster, from
                              the managed cluster. If not present, the default value of the work agent will be used.
                            pattern: ^([0-9]+(s|m|h))+$
                            type: string
                          featureGates:
                            description: "FeatureGates represents the list of feature
                              gates for work\nIf it is set empty, default feature
                              gates will be used.\nIf it is set, featuregate/Foo is
                              an example of one item in FeatureGates:\n  1. If featuregate/Foo
                              does not exist, registration-operator will discard it\n
                              \ 2. If featuregate/Foo exists and is false by default.
                              It is now possible to set featuregate/Foo=[false|true]\n
                              \ 3. If featuregate/Foo exists and is true by default.
                              If a cluster-admin upgrading from 1 to 2 wants to continue
                              having featuregate/Foo=false,\n \the can set featuregate/Foo=false
                              before upgrading. Let's say the cluster-admin wants
                              featuregate/Foo=false."
                            items:
                              properties:
                                feature:
                                  description: Feature is the key of feature gate.
                                    e.g. featuregate/Foo.
                                  type: string
                                mode:
                                  default: Disable
                                  description: |-
                                    Mode is either Enable, Disable, "" where "" is Disable by default.
                                    In Enable mode, a valid feature gate `featuregate/Foo` will be set to "--featuregate/Foo=true".
                                    In Disable mode, a valid feature gate `featuregate/Foo` will be set to "--featuregate/Foo=false".
                                  enum:
                                  - Enable
                                  - Disable
                                  type: string
                              required:
                              - feature
                              type: object
                            type: array
                          kubeAPIBurst:
                            default: 100
                            description: |-
                              KubeAPIBurst indicates the maximum burst of the throttle while talking with apiserver of hub cluster from the spoke cluster.
                              If it is set empty, use the default value: 100
                            format: int32
                            type: integer
                          kubeAPIQPS:
                            default: 50
                            description: |-
                              KubeAPIQPS indicates the maximum QPS while talking with apiserver of hub cluster from the spoke cluster.
                              If it is set empty, use the default value: 50
                            format: int32
                            type: integer
                        type: object
                      workImagePullSpec:
                        description: |-
                          WorkImagePullSpec represents the desired image configuration of work agent.
                          quay.io/open-cluster-management.io/work:latest will be used if unspecified.
                        type: string
                    type: object
                  status:
                    description: Status represents the current status of Klusterlet
                      agent.
                    properties:
                      conditions:
                        description: |-
                          Conditions contain the different condition statuses for this Klusterlet.
                          Valid condition types are:
                          Applied: Components have been applied in the managed cluster.
                          Available: Components in the managed cluster are available and ready to serve.
                          Progressing: Components in the managed cluster are in a transitioning state.
                          Degraded: Components in the managed cluster do not match the desired configuration and only provide
                          degraded service.
                        items:
                          description: "Condition contains details for one aspect
                            of the current state of this API Resource.\n---\nThis
                            struct is intended for direct use as an array at the field
                            path .status.conditions.  For example,\n\n\n\ttype FooStatus
                            struct{\n\t    // Represents the observations of a foo's
                            current state.\n\t    // Known .status.conditions.type
                            are: \"Available\", \"Progressing\", and \"Degraded\"\n\t
                            \   // +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t
                            \   // +listType=map\n\t    // +listMapKey=type\n\t    Conditions
                            []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\"
                            patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
                            \   // other fields\n\t}"
                          properties:
                            lastTransitionTime:
                              description: |-
                                lastTransitionTime is the last time the condition transitioned from one status to another.
                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                              format: date-time
                              type: string
                            message:
                              description: |-
                                message is a human readable message indicating details about the transition.
                                This may be an empty string.
                              maxLength: 32768
                              type: string
                            observedGeneration:
                              description: |-
                                observedGeneration represents the .metadata.generation that the condition was set based upon.
                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                                with respect to the current state of the instance.
                              format: int64
                              minimum: 0
                              type: integer
                            reason:
                              description: |-
                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
                                Producers of specific condition types may define expected values and meanings for this field,
                                and whether the values are considered a guaranteed API.
                                The value should be a CamelCase string.
                                This field may not be empty.
                              maxLength: 1024
                              minLength: 1
                              pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                              type: string
                            status:
                              description: status of the condition, one of True, False,
                                Unknown.
                              enum:
                              - "True"
                              - "False"
                              - Unknown
                              type: string
                            type:
                              description: |-
                                type of condition in CamelCase or in foo.example.com/CamelCase.
                                ---
                                Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
                                useful (see .node.status.conditions), the ability to deconflict is important.
                                The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                              maxLength: 316
                              pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                              type: string
                          required:
                          - lastTransitionTime
                          - message
                          - reason
                          - status
                          - type
                          type: object
                        type: array
                      generations:
                        description: Generations are used to determine when an item
                          needs to be reconciled or has changed in a way that needs
                          a reaction.
                        items:
                          description: |-
                            GenerationStatus keeps track of the generation for a given resource so that decisions about forced updates can be made.
                            The definition matches the GenerationStatus defined in github.com/openshift/api/v1
                          properties:
                            group:
                              description: group is the group of the resource that
                                you're tracking
                              type: string
                            lastGeneration:
                              description: lastGeneration is the last generation of
                                the resource that controller applies
                              format: int64
                              type: integer
                            name:
                              description: name is the name of the resource that you're
                                tracking
                              type: string
                            namespace:
                              description: namespace is where the resource that you're
                                tracking is
                              type: string
                            resource:
                              description: resource is the resource type of the resource
                                that you're tracking
                              type: string
                            version:
                              description: version is the version of the resource
                                that you're tracking
                              type: string
                          type: object
                        type: array
                      observedGeneration:
                        description: ObservedGeneration is the last generation change
                          you've dealt with
                        format: int64
                        type: integer
                      relatedResources:
                        description: RelatedResources are used to track the resources
                          that are related to this Klusterlet.
                        items:
                          description: RelatedResourceMeta represents the resource
                            that is managed by an operator
                          properties:
                            group:
                              description: group is the group of the resource that
                                you're tracking
                              type: string
                            name:
                              description: name is the name of the resource that you're
                                tracking
                              type: string
                            namespace:
                              description: namespace is where the thing you're tracking
                                is
                              type: string
                            resource:
                              description: resource is the resource type of the resource
                                that you're tracking
                              type: string
                            version:
                              description: version is the version of the thing you're
                                tracking
                              type: string
                          type: object
                        type: array
                    type: object
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
          conditions: []
          storedVersions: []
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T03:58:44Z"
      message: Apply manifest work complete
      observedGeneration: 1
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T03:58:44Z"
      message: All resources are available
      observedGeneration: 1
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T03:58:44Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: klusterlets.operator.open-cluster-management.io
          namespace: ""
          ordinal: 0
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
- apiVersion: work.open-cluster-management.io/v1
  kind: ManifestWork
  metadata:
    annotations:
      open-cluster-management/postpone-delete: ""
    creationTimestamp: "2024-10-30T04:02:45Z"
    finalizers:
    - cluster.open-cluster-management.io/manifest-work-cleanup
    generation: 1
    labels:
      owner: multicluster-observability-operator
    name: vm02980-observability
    namespace: vm02980
    resourceVersion: "6080916"
    uid: 422fdf2c-2125-495d-a890-d8323d68ec7f
  spec:
    workload:
      manifests:
      - apiVersion: observability.open-cluster-management.io/v1beta1
        kind: ObservabilityAddon
        metadata:
          name: observability-addon
          namespace: open-cluster-management-addon-observability
        spec:
          enableMetrics: true
          interval: 300
          resources:
            requests:
              cpu: 10m
              memory: 100Mi
        status:
          conditions: null
      - apiVersion: v1
        kind: Namespace
        metadata:
          annotations:
            workload.openshift.io/allowed: management
          name: open-cluster-management-addon-observability
        spec: {}
        status: {}
      - apiVersion: v1
        data:
          ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURjakNDQWxxZ0F3SUJBZ0lRSTAwM2l4MzNCZ1lpVi9PalZZZ3JGVEFOQmdrcWhraUc5dzBCQVFzRkFEQlQKTVFzd0NRWURWUVFHRXdKVlV6RVdNQlFHQTFVRUNoTU5VbVZrSUVoaGRDd2dTVzVqTGpFc01Db0dBMVVFQXhNagpiMkp6WlhKMllXSnBiR2wwZVMxelpYSjJaWEl0WTJFdFkyVnlkR2xtYVdOaGRHVXdIaGNOTWpReE1ESTVNVGcwCk5qUXhXaGNOTWpreE1ESTRNVGcwTmpReFdqQlRNUXN3Q1FZRFZRUUdFd0pWVXpFV01CUUdBMVVFQ2hNTlVtVmsKSUVoaGRDd2dTVzVqTGpFc01Db0dBMVVFQXhNamIySnpaWEoyWVdKcGJHbDBlUzF6WlhKMlpYSXRZMkV0WTJWeQpkR2xtYVdOaGRHVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFEcW40ZGdocmtTCjRwbjVvdDVwS3lQQ0tETmRpM0ZzMGN0ci9ocDVrTzk4Y2c0UVFiOVo4b1VkRXZCSHBZbTFnais1cWlRcWRETUQKSHNsTGNDSlB2SzdPNU92M0ZGeUhoV3BzeTlTM3J5Rk5hK3RMWlJYZmZidjVjV1Z3WDZXLy9SNjY3S0trRDZVSApOdmg1TzdIalJUSVVCaEdtckhBWWFoK2t1bXhHRTRxVVR4US83dGlFTGlmalFjSXVBdkozN1RSUytFNTdXbmM3CmhuN2theDlHd1J6KzFLTXZEUmpTYllrQUk5Q3dzYnhONlhyblBnZEpyVEo5VTN5QmhiSkF1d2RzYnc3Q1ZFOHkKMzJiRmIyQUpCTVJMVlVHOTFkMzVOVCtYUC9NODNDSzVwRC8zeVJjd3ZmQ01wTm44OFI3aVAva3k4eW93Wk41bApZb3UycElJY3pmYmhBZ01CQUFHalFqQkFNQTRHQTFVZER3RUIvd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFECkFRSC9NQjBHQTFVZERnUVdCQlRscU81bC9SRnhwTnNuNXJ3OUU0LzkwQUN4VWpBTkJna3Foa2lHOXcwQkFRc0YKQUFPQ0FRRUFUUnVDZXVRQk1GUUpWTGU2Qmt4elFCcWJzQStSbEhxRjVRRDh5aVRpVjdoM0ZSc2VTTTZCVk1KOApDYUdTQWpGRm94RERrbjErbis3SUZJMm53U1ozQzVNZVZCQjdHS3Z6cWxxQVFBaEd3WXIrTlo2OCt3SHc5cC9wCi9FeVRGY25GaTdXeWlLOE5oU3VDT25BbDJDSTBXcGlmYkI1a0NCMG44OXVvM0lsdTFTbTZ2ZlpDWTl5cFJNbm4KY2tIRllRVWdsUUx5QVBsbzloTWtqczNrQUZzQUpPNDdXUEZSL1N3dHVoU0d0eXBzOWZlb1JFSy8vbTIweVlnKwo0NFdSaFdMTlFpMWkvY2tEL2x6VW9KTFBpWmlaMS9Tb2d2WGx4aExGK3FnNXlqdUUrbTNsSzFJV05sUnBXSUNqCk0waW5RR0hhUmh5VU1pMnY5ZlNDWEE1bmI2ZVhrUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
        kind: Secret
        metadata:
          name: observability-managed-cluster-certs
          namespace: open-cluster-management-addon-observability
      - apiVersion: v1
        data:
          token: notsecret
        kind: Secret
        metadata:
          name: observability-alertmanager-accessor
          namespace: open-cluster-management-addon-observability
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            owner: multicluster-observability-operator
            rbac.authorization.k8s.io/aggregate-to-admin: "true"
          name: aggregate-observabilityaddons-edit
        rules:
        - apiGroups:
          - observability.open-cluster-management.io
          resources:
          - observabilityaddons
          verbs:
          - get
          - list
          - watch
          - create
          - delete
          - update
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            owner: multicluster-observability-operator
          name: open-cluster-management:endpoint-observability-operator
        rules:
        - apiGroups:
          - apiextensions.k8s.io
          resources:
          - customresourcedefinitions
          verbs:
          - '*'
        - apiGroups:
          - ""
          resources:
          - nodes
          - nodes/proxy
          verbs:
          - list
          - watch
          - get
        - apiGroups:
          - ""
          resources:
          - configmaps
          - pods
          - secrets
          - services
          - services/finalizers
          - serviceaccounts
          verbs:
          - '*'
        - apiGroups:
          - apps
          resources:
          - deployments
          - daemonsets
          - replicasets
          - statefulsets
          verbs:
          - '*'
        - apiGroups:
          - rbac.authorization.k8s.io
          resources:
          - clusterroles
          - clusterrolebindings
          - roles
          - rolebindings
          verbs:
          - '*'
        - apiGroups:
          - observability.open-cluster-management.io
          resources:
          - multiclusterobservabilities
          - observabilityaddons
          verbs:
          - list
          - watch
          - get
        - apiGroups:
          - observability.open-cluster-management.io
          resources:
          - observabilityaddons/status
          verbs:
          - get
          - update
        - apiGroups:
          - observability.open-cluster-management.io
          resources:
          - observabilityaddons/finalizers
          verbs:
          - update
        - apiGroups:
          - config.openshift.io
          resources:
          - clusterversions
          - infrastructures
          verbs:
          - list
          - watch
          - get
        - apiGroups:
          - work.open-cluster-management.io
          resources:
          - appliedmanifestworks
          verbs:
          - get
        - apiGroups:
          - work.open-cluster-management.io
          resources:
          - appliedmanifestworks/finalizers
          verbs:
          - update
        - apiGroups:
          - coordination.k8s.io
          resources:
          - leases
          verbs:
          - '*'
        - apiGroups:
          - ""
          resources:
          - nodes/metrics
          verbs:
          - get
        - nonResourceURLs:
          - /metrics
          - /federate
          verbs:
          - get
        - apiGroups:
          - authentication.k8s.io
          resources:
          - tokenreviews
          verbs:
          - create
        - apiGroups:
          - authorization.k8s.io
          resources:
          - subjectaccessreviews
          verbs:
          - create
        - apiGroups:
          - networking.k8s.io
          resources:
          - networkpolicies
          - ingresses
          verbs:
          - get
          - list
          - watch
        - apiGroups:
          - ""
          resources:
          - endpoints
          - limitranges
          - namespaces
          - persistentvolumeclaims
          - persistentvolumes
          - replicationcontrollers
          - resourcequotas
          verbs:
          - '*'
        - apiGroups:
          - admissionregistration.k8s.io
          resources:
          - mutatingwebhookconfigurations
          - validatingwebhookconfigurations
          verbs:
          - list
          - watch
        - apiGroups:
          - autoscaling
          resources:
          - horizontalpodautoscalers
          verbs:
          - list
          - watch
        - apiGroups:
          - batch
          resources:
          - cronjobs
          - jobs
          verbs:
          - list
          - watch
        - apiGroups:
          - certificates.k8s.io
          resources:
          - certificatesigningrequests
          verbs:
          - list
          - watch
        - apiGroups:
          - policy
          resources:
          - poddisruptionbudgets
          verbs:
          - list
          - watch
        - apiGroups:
          - storage.k8s.io
          resources:
          - storageclasses
          - volumeattachments
          verbs:
          - list
          - watch
        - apiGroups:
          - extensions
          resources:
          - ingresses
          verbs:
          - get
          - list
          - watch
        - apiGroups:
          - monitoring.coreos.com
          resources:
          - alertmanagers
          - alertmanagers/finalizers
          - alertmanagerconfigs
          - prometheuses
          - prometheuses/finalizers
          - thanosrulers
          - thanosrulers/finalizers
          - servicemonitors
          - podmonitors
          - probes
          - prometheusrules
          verbs:
          - '*'
        - apiGroups:
          - hypershift.openshift.io
          resources:
          - hostedclusters
          verbs:
          - get
          - list
          - watch
      - apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            owner: multicluster-observability-operator
          name: open-cluster-management:endpoint-observability-operator-rb
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:endpoint-observability-operator
        subjects:
        - kind: ServiceAccount
          name: endpoint-observability-operator-sa
          namespace: open-cluster-management-addon-observability
      - apiVersion: v1
        imagePullSecrets:
        - name: multiclusterhub-operator-pull-secret
        kind: ServiceAccount
        metadata:
          name: endpoint-observability-operator-sa
          namespace: open-cluster-management-addon-observability
      - apiVersion: v1
        data:
          metrics_list.yaml: |
            names:
            - :node_memory_MemAvailable_bytes:sum
            - ALERTS
            - acm_managed_cluster_labels
            - authenticated_user_requests
            - authentication_attempts
            - cluster:capacity_cpu_cores:sum
            - cluster:capacity_memory_bytes:sum
            - cluster:container_cpu_usage:ratio
            - cluster:container_spec_cpu_shares:ratio
            - cluster:cpu_usage_cores:sum
            - cluster:memory_usage:ratio
            - cluster:memory_usage_bytes:sum
            - cluster:node_cpu:ratio
            - cluster:usage:resources:sum
            - cluster_infrastructure_provider
            - cluster_version
            - cluster_version_payload
            - container_cpu_cfs_periods_total
            - container_cpu_cfs_throttled_periods_total
            - container_spec_cpu_quota
            - coredns_dns_requests_total
            - coredns_dns_request_duration_seconds_sum
            - coredns_forward_responses_total
            - csv_succeeded
            - csv_abnormal
            - etcd_debugging_mvcc_db_total_size_in_bytes
            - etcd_mvcc_db_total_size_in_bytes
            - etcd_debugging_snap_save_total_duration_seconds_sum
            - etcd_disk_backend_commit_duration_seconds_bucket
            - etcd_disk_backend_commit_duration_seconds_sum
            - etcd_disk_wal_fsync_duration_seconds_bucket
            - etcd_disk_wal_fsync_duration_seconds_sum
            - etcd_object_counts
            - etcd_network_client_grpc_received_bytes_total
            - etcd_network_client_grpc_sent_bytes_total
            - etcd_network_peer_received_bytes_total
            - etcd_network_peer_sent_bytes_total
            - etcd_server_client_requests_total
            - etcd_server_has_leader
            - etcd_server_health_failures
            - etcd_server_leader_changes_seen_total
            - etcd_server_proposals_failed_total
            - etcd_server_proposals_pending
            - etcd_server_proposals_committed_total
            - etcd_server_proposals_applied_total
            - etcd_server_quota_backend_bytes
            - grpc_server_started_total
            - haproxy_backend_connection_errors_total
            - haproxy_backend_connections_total
            - haproxy_backend_current_queue
            - haproxy_backend_http_average_response_latency_milliseconds
            - haproxy_backend_max_sessions
            - haproxy_backend_response_errors_total
            - haproxy_backend_up
            - http_requests_total
            - instance:node_filesystem_usage:sum
            - instance:node_cpu_utilisation:rate1m
            - instance:node_load1_per_cpu:ratio
            - instance:node_memory_utilisation:ratio
            - instance:node_network_receive_bytes_excluding_lo:rate1m
            - instance:node_network_receive_drop_excluding_lo:rate1m
            - instance:node_network_transmit_bytes_excluding_lo:rate1m
            - instance:node_network_transmit_drop_excluding_lo:rate1m
            - instance:node_num_cpu:sum
            - instance:node_vmstat_pgmajfault:rate1m
            - instance_device:node_disk_io_time_seconds:rate1m
            - instance_device:node_disk_io_time_weighted_seconds:rate1m
            - kube_daemonset_status_desired_number_scheduled
            - kube_daemonset_status_number_unavailable
            - kube_node_spec_unschedulable
            - kube_node_status_allocatable
            - kube_node_status_allocatable_cpu_cores
            - kube_node_status_allocatable_memory_bytes
            - kube_node_status_capacity
            - kube_node_status_capacity_pods
            - kube_node_status_capacity_cpu_cores
            - kube_node_status_condition
            - kube_pod_container_resource_limits
            - kube_pod_container_resource_limits_cpu_cores
            - kube_pod_container_resource_limits_memory_bytes
            - kube_pod_container_resource_requests
            - kube_pod_container_resource_requests_cpu_cores
            - kube_pod_container_resource_requests_memory_bytes
            - kube_pod_info
            - kube_pod_owner
            - kube_resourcequota
            - kubelet_running_container_count
            - kubelet_runtime_operations
            - kubelet_runtime_operations_duration_seconds_sum
            - kubelet_volume_stats_available_bytes
            - kubelet_volume_stats_capacity_bytes
            - kube_persistentvolume_status_phase
            - machine_cpu_cores
            - machine_memory_bytes
            - mce_hs_addon_request_based_hcp_capacity_gauge
            - mce_hs_addon_low_qps_based_hcp_capacity_gauge
            - mce_hs_addon_medium_qps_based_hcp_capacity_gauge
            - mce_hs_addon_high_qps_based_hcp_capacity_gauge
            - mce_hs_addon_average_qps_based_hcp_capacity_gauge
            - mce_hs_addon_total_hosted_control_planes_gauge
            - mce_hs_addon_available_hosted_control_planes_gauge
            - mce_hs_addon_available_hosted_clusters_gauge
            - mce_hs_addon_deleted_hosted_clusters_gauge
            - mce_hs_addon_hypershift_operator_degraded_bool
            - mce_hs_addon_hosted_control_planes_status_gauge
            - mce_hs_addon_qps_based_hcp_capacity_gauge
            - mce_hs_addon_worker_node_resource_capacities_gauge
            - mce_hs_addon_qps_gauge
            - mce_hs_addon_request_based_hcp_capacity_current_gauge
            - mixin_pod_workload
            - namespace:kube_pod_container_resource_requests_cpu_cores:sum
            - namespace_memory:kube_pod_container_resource_requests:sum
            - namespace:container_memory_usage_bytes:sum
            - namespace_cpu:kube_pod_container_resource_requests:sum
            - namespace_workload_pod:kube_pod_owner:relabel
            - node_cpu_seconds_total
            - node_filesystem_avail_bytes
            - node_filesystem_free_bytes
            - node_filesystem_size_bytes
            - node_memory_MemAvailable_bytes
            - node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate
            - node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate
            - node_netstat_Tcp_OutSegs
            - node_netstat_Tcp_RetransSegs
            - node_netstat_TcpExt_TCPSynRetrans
            - policyreport_info
            - up
            - prometheus_operator_reconcile_errors_total
            - prometheus_operator_reconcile_operations_total
            - cluster_operator_conditions
            - cluster_operator_up
            - cluster:policy_governance_info:propagated_count
            - cluster:policy_governance_info:propagated_noncompliant_count
            - policy:policy_governance_info:propagated_count
            - policy:policy_governance_info:propagated_noncompliant_count
            - cnv:vmi_status_running:count
            - kubevirt_hyperconverged_operator_health_status
            - kubevirt_hco_system_health_status
            - kubevirt_vmi_info
            - kubevirt_vm_running_status_last_transition_timestamp_seconds
            - kubevirt_vm_non_running_status_last_transition_timestamp_seconds
            - kubevirt_vm_error_status_last_transition_timestamp_seconds
            - kubevirt_vm_starting_status_last_transition_timestamp_seconds
            - kubevirt_vm_migrating_status_last_transition_timestamp_seconds
            - kubevirt_vmi_memory_available_bytes
            - kubevirt_vmi_memory_unused_bytes
            - kubevirt_vmi_memory_cached_bytes
            - kubevirt_vmi_memory_used_bytes
            - kubevirt_vmi_phase_count
            - kubevirt_vmi_cpu_usage_seconds_total
            - kubevirt_vmi_network_receive_bytes_total
            - kubevirt_vmi_network_transmit_bytes_total
            - kubevirt_vmi_network_receive_packets_total
            - kubevirt_vmi_network_transmit_packets_total
            - kubevirt_vmi_storage_iops_read_total
            - kubevirt_vmi_storage_iops_write_total
            - kubevirt_vm_resource_requests
            matches:
            - __name__="workqueue_queue_duration_seconds_bucket",job="apiserver"
            - __name__="workqueue_adds_total",job="apiserver"
            - __name__="workqueue_depth",job="apiserver"
            - __name__="go_goroutines",job="apiserver"
            - __name__="process_cpu_seconds_total",job="apiserver"
            - __name__="process_resident_memory_bytes",job=~"apiserver|etcd"
            - __name__="container_memory_cache",container!=""
            - __name__="container_memory_rss",container!=""
            - __name__="container_memory_swap",container!=""
            - __name__="container_memory_working_set_bytes",container!=""
            renames:
              etcd_mvcc_db_total_size_in_bytes: etcd_debugging_mvcc_db_total_size_in_bytes
              mixin_pod_workload: namespace_workload_pod:kube_pod_owner:relabel
              namespace:kube_pod_container_resource_requests_cpu_cores:sum: namespace_cpu:kube_pod_container_resource_requests:sum
              node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate: node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate
            rules: []
            recording_rules:
            - record: apiserver_request_duration_seconds:histogram_quantile_99
              expr: histogram_quantile(0.99,sum(rate(apiserver_request_duration_seconds_bucket{job=\"apiserver\",
                verb!=\"WATCH\"}[5m])) by (le))
            - record: apiserver_request_duration_seconds:histogram_quantile_99:instance
              expr: histogram_quantile(0.99, sum(rate(apiserver_request_duration_seconds_bucket{job=\"apiserver\",
                verb!=\"WATCH\"}[5m])) by (le, verb, instance))
            - record: sum:apiserver_request_total:1h
              expr: sum(rate(apiserver_request_total{job=\"apiserver\"}[1h])) by(code, instance)
            - record: sum:apiserver_request_total:5m
              expr: sum(rate(apiserver_request_total{job=\"apiserver\"}[5m])) by(code, instance)
            - record: rpc_rate:grpc_server_handled_total:sum_rate
              expr: sum(rate(grpc_server_handled_total{job=\"etcd\",grpc_type=\"unary\",grpc_code!=\"OK\"}[5m]))
            - record: active_streams_watch:grpc_server_handled_total:sum
              expr: sum(grpc_server_started_total{job=\"etcd\",grpc_service=\"etcdserverpb.Watch\",grpc_type=\"bidi_stream\"})
                - sum(grpc_server_handled_total{job=\"etcd\",grpc_service=\"etcdserverpb.Watch\",grpc_type=\"bidi_stream\"})
            - record: active_streams_lease:grpc_server_handled_total:sum
              expr: sum(grpc_server_started_total{job=\"etcd\",grpc_service=\"etcdserverpb.Lease\",grpc_type=\"bidi_stream\"})
                - sum(grpc_server_handled_total{job=\"etcd\",grpc_service=\"etcdserverpb.Lease\",grpc_type=\"bidi_stream\"})
            - record: cluster:kube_pod_container_resource_requests:cpu:sum
              expr: sum(sum(sum(kube_pod_container_resource_requests{resource=\"cpu\"}) by (pod,namespace,container)
                * on(pod,namespace) group_left(phase) max(kube_pod_status_phase{phase=~\"Running|Pending|Unknown\"}
                >0) by (pod,namespace,phase)) by (pod,namespace,phase))
            - record: cluster:kube_pod_container_resource_requests:memory:sum
              expr: sum(sum(sum(kube_pod_container_resource_requests{resource=\"memory\"}) by
                (pod,namespace,container) * on(pod,namespace) group_left(phase) max(kube_pod_status_phase{phase=~\"Running|Pending|Unknown\"}
                >0) by (pod,namespace,phase)) by (pod,namespace,phase))
            - record: sli:apiserver_request_duration_seconds:trend:1m
              expr: sum(increase(apiserver_request_duration_seconds_bucket{job=\"apiserver\",service=\"kubernetes\",le=\"1\",verb=~\"POST|PUT|DELETE|PATCH\"}[1m]))
                / sum(increase(apiserver_request_duration_seconds_count{job=\"apiserver\",service=\"kubernetes\",verb=~\"POST|PUT|DELETE|PATCH\"}[1m]))
            - record: container_memory_rss:sum
              expr: sum(container_memory_rss) by (container, namespace)
            - record: kube_pod_container_resource_limits:sum
              expr: sum(kube_pod_container_resource_limits) by (resource, namespace)
            - record: kube_pod_container_resource_requests:sum
              expr: sum(kube_pod_container_resource_requests{container!=\"\"}) by (resource, namespace)
            - record: namespace_workload_pod:kube_pod_owner:relabel:avg
              expr: count(avg(namespace_workload_pod:kube_pod_owner:relabel{pod!=\"\"}) by (workload,
                namespace)) by (namespace)
            - record: node_namespace_pod_container:container_cpu_usage_seconds_total:sum
              expr: sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{container!=\"\"})
                by (namespace) or sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate{container!=\"\"})
                by (namespace)
            collect_rules:
            - group: SNOResourceUsage
              annotations:
                description: |
                  By default, a SNO cluster does not collect pod and container resource metrics. Once a SNO cluster  reaches a level of resource consumption, these granular metrics are collected dynamically.  When the cluster resource consumption is consistently less than the threshold for a period of time,  collection of the granular metrics stops.
              selector:
                matchExpressions:
                - key: clusterType
                  operator: In
                  values:
                  - SNO
              rules:
              - collect: SNOHighCPUUsage
                annotations:
                  description: |
                    Collects the dynamic metrics specified if the cluster cpu usage is constantly more than 70% for 2 minutes
                expr: (1 - avg(rate(node_cpu_seconds_total{mode=\"idle\"}[5m]))) * 100 > 70
                for: 2m
                dynamic_metrics:
                  names:
                  - container_cpu_cfs_periods_total
                  - container_cpu_cfs_throttled_periods_total
                  - kube_pod_container_resource_limits
                  - kube_pod_container_resource_requests
                  - namespace_workload_pod:kube_pod_owner:relabel
                  - node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate
                  - node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate
                  matches: []
              - collect: SNOHighMemoryUsage
                annotations:
                  description: |
                    Collects the dynamic metrics specified if the cluster memory usage is constantly more than 70% for 2 minutes
                expr: (1 - sum(:node_memory_MemAvailable_bytes:sum) / sum(kube_node_status_allocatable{resource=\"memory\"}))
                  * 100 > 70
                for: 2m
                dynamic_metrics:
                  names:
                  - kube_pod_container_resource_limits
                  - kube_pod_container_resource_requests
                  - namespace_workload_pod:kube_pod_owner:relabel
                  matches:
                  - __name__="container_memory_cache",container!=""
                  - __name__="container_memory_rss",container!=""
                  - __name__="container_memory_swap",container!=""
                  - __name__="container_memory_working_set_bytes",container!=""
          uwl_metrics_list.yaml: |
            names:
            - ALERTS
            - apiserver_current_inflight_requests
            - apiserver_request_count
            - apiserver_request_duration_seconds_bucket
            - apiserver_request_total
            - apiserver_storage_objects
            - etcd_debugging_mvcc_db_total_size_in_bytes
            - etcd_mvcc_db_total_size_in_bytes
            - etcd_debugging_snap_save_total_duration_seconds_sum
            - etcd_disk_backend_commit_duration_seconds_bucket
            - etcd_disk_backend_commit_duration_seconds_sum
            - etcd_disk_wal_fsync_duration_seconds_bucket
            - etcd_disk_wal_fsync_duration_seconds_sum
            - etcd_object_counts
            - etcd_network_client_grpc_received_bytes_total
            - etcd_network_client_grpc_sent_bytes_total
            - etcd_network_peer_received_bytes_total
            - etcd_network_peer_sent_bytes_total
            - etcd_server_client_requests_total
            - etcd_server_has_leader
            - etcd_server_health_failures
            - etcd_server_leader_changes_seen_total
            - etcd_server_proposals_failed_total
            - etcd_server_proposals_pending
            - etcd_server_proposals_committed_total
            - etcd_server_proposals_applied_total
            - etcd_server_quota_backend_bytes
            - up
            matches:
            - __name__="process_resident_memory_bytes",job=~"apiserver|etcd"
            - __name__="grpc_server_started_total",job="etcd"
            - __name__="grpc_server_handled_total",job="etcd"
            - __name__="go_goroutines",job="apiserver"
            - __name__="process_cpu_seconds_total",job="apiserver"
            - __name__="workqueue_adds_total",job="apiserver"
            - __name__="workqueue_depth",job="apiserver"
            - __name__="workqueue_queue_duration_seconds_bucket",job="apiserver"
            renames:
              etcd_mvcc_db_total_size_in_bytes: etcd_debugging_mvcc_db_total_size_in_bytes
            rules: []
            recording_rules:
            - record: apiserver_request_duration_seconds:histogram_quantile_99
              expr: histogram_quantile(0.99,sum(rate(apiserver_request_duration_seconds_bucket{job=\"apiserver\",
                verb!=\"WATCH\", _id!=\"\"}[5m])) by (le, _id))
            - record: sum:apiserver_request_total:1h
              expr: sum(rate(apiserver_request_total{job=\"apiserver\", _id!=\"\"}[1h])) by(code,
                instance, _id)
            - record: sum:apiserver_request_total:5m
              expr: sum(rate(apiserver_request_total{job=\"apiserver\"}[5m])) by(code, instance)
            - record: rpc_rate:grpc_server_handled_total:sum_rate
              expr: sum(rate(grpc_server_handled_total{job=\"etcd\",grpc_type=\"unary\",grpc_code!=\"OK\"}[5m]))
            - record: active_streams_watch:grpc_server_handled_total:sum
              expr: sum(grpc_server_started_total{job=\"etcd\",grpc_service=\"etcdserverpb.Watch\",grpc_type=\"bidi_stream\"})
                - sum(grpc_server_handled_total{job=\"etcd\",grpc_service=\"etcdserverpb.Watch\",grpc_type=\"bidi_stream\"})
            - record: active_streams_lease:grpc_server_handled_total:sum
              expr: sum(grpc_server_started_total{job=\"etcd\",grpc_service=\"etcdserverpb.Lease\",grpc_type=\"bidi_stream\"})
                - sum(grpc_server_handled_total{job=\"etcd\",grpc_service=\"etcdserverpb.Lease\",grpc_type=\"bidi_stream\"})
            collect_rules: []
        kind: ConfigMap
        metadata:
          name: observability-metrics-allowlist
          namespace: open-cluster-management-addon-observability
      - apiVersion: apiextensions.k8s.io/v1
        kind: CustomResourceDefinition
        metadata:
          annotations:
            controller-gen.kubebuilder.io/version: v0.4.1
          name: observabilityaddons.observability.open-cluster-management.io
        spec:
          group: observability.open-cluster-management.io
          names:
            kind: ObservabilityAddon
            listKind: ObservabilityAddonList
            plural: observabilityaddons
            shortNames:
            - oba
            singular: observabilityaddon
          scope: Namespaced
          versions:
          - name: v1beta1
            schema:
              openAPIV3Schema:
                properties:
                  apiVersion:
                    type: string
                  kind:
                    type: string
                  metadata:
                    type: object
                  spec:
                    properties:
                      enableMetrics:
                        default: true
                        type: boolean
                      interval:
                        default: 300
                        format: int32
                        maximum: 3600
                        minimum: 15
                        type: integer
                      resources:
                        properties:
                          limits:
                            additionalProperties:
                              anyOf:
                              - type: integer
                              - type: string
                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                              x-kubernetes-int-or-string: true
                            type: object
                          requests:
                            additionalProperties:
                              anyOf:
                              - type: integer
                              - type: string
                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                              x-kubernetes-int-or-string: true
                            type: object
                        type: object
                    type: object
                  status:
                    properties:
                      conditions:
                        items:
                          properties:
                            lastTransitionTime:
                              format: date-time
                              type: string
                            message:
                              type: string
                            reason:
                              type: string
                            status:
                              type: string
                            type:
                              type: string
                          required:
                          - lastTransitionTime
                          - message
                          - reason
                          - status
                          - type
                          type: object
                        type: array
                    required:
                    - conditions
                    type: object
                type: object
            served: true
            storage: true
            subresources:
              status: {}
        status:
          acceptedNames:
            kind: ""
            plural: ""
          conditions: []
          storedVersions: []
      - apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: endpoint-observability-operator
          namespace: open-cluster-management-addon-observability
        spec:
          replicas: 1
          selector:
            matchLabels:
              name: endpoint-observability-operator
          strategy: {}
          template:
            metadata:
              annotations:
                target.workload.openshift.io/management: '{"effect":"PreferredDuringScheduling"}'
              creationTimestamp: null
              labels:
                name: endpoint-observability-operator
            spec:
              containers:
              - command:
                - endpoint-monitoring-operator
                env:
                - name: HUB_NAMESPACE
                  value: vm02980
                - name: WATCH_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: SERVICE_ACCOUNT
                  valueFrom:
                    fieldRef:
                      fieldPath: spec.serviceAccountName
                - name: OPERATOR_NAME
                  value: endpoint-monitoring-operator
                - name: HUB_KUBECONFIG
                  value: /spoke/hub-kubeconfig/kubeconfig
                - name: INSTALL_PROM
                  value: "false"
                - name: PULL_SECRET
                  value: multiclusterhub-operator-pull-secret
                image: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/endpoint-monitoring-rhel9-operator@sha256:0075f0ab57fabaa7d4d2d13639b506d59fe6f20f626a0c36c704107ce5e226fd
                imagePullPolicy: IfNotPresent
                name: endpoint-observability-operator
                ports:
                - containerPort: 8383
                  name: metrics
                  protocol: TCP
                resources:
                  requests:
                    cpu: 2m
                    memory: 50Mi
                securityContext:
                  privileged: false
                  readOnlyRootFilesystem: true
                volumeMounts:
                - mountPath: /spoke/hub-kubeconfig
                  name: hub-kubeconfig-secret
                  readOnly: true
              serviceAccountName: endpoint-observability-operator-sa
              volumes:
              - name: hub-kubeconfig-secret
                secret:
                  secretName: observability-controller-hub-kubeconfig
        status: {}
      - apiVersion: v1
        data:
          .dockerconfigjson: e30=
        kind: Secret
        metadata:
          name: multiclusterhub-operator-pull-secret
          namespace: open-cluster-management-addon-observability
        type: kubernetes.io/dockerconfigjson
      - apiVersion: v1
        data:
          kube_rbac_proxy: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/kube-rbac-proxy-rhel9@sha256:b8bdb5e8f1b40a3ab7d523d2f5593baeb072a7675ce6548713f90e90af720ec7
          kube_state_metrics: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/kube-state-metrics-rhel9@sha256:555825d979ea72deccfb222ae086b0a31885731e60631e2e4113b2cfe0174906
          metrics_collector: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/metrics-collector-rhel9@sha256:8a982664f06fbfcce2cb7aadc1c5ab26ed2183796800c1eef102de3af100ec03
          node_exporter: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/node-exporter-rhel9@sha256:3238ec34f6af37f19742d22a64290f218c0585b2c7c8a6a97e990341657493a5
          prometheus: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/prometheus-rhel9@sha256:241600c59f7d1a9c94f7a977251fea29785b0ab2225009e7c1223479d4fcec91
          prometheus_config_reloader: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/acm-prometheus-config-reloader-rhel9@sha256:46121f1ffcc4653001b47fe9c893e2da64b2f41b1880888927c587191811f232
          prometheus_operator: d16-h01-000-r650.rdu2.scalelab.redhat.com:5000/acm-d/acm-prometheus-rhel9@sha256:f2559e7c05677120f5e257e555da2c46fb4bd386bd618a8db7265692afe50f2b
        kind: ConfigMap
        metadata:
          name: images-list
          namespace: open-cluster-management-addon-observability
      - apiVersion: v1
        data:
          cluster-name: dm0wMjk4MA==
          hub-info.yaml: Y2x1c3Rlci1uYW1lOiAiIgpvYnNlcnZhdG9yaXVtLWFwaS1lbmRwb2ludDogaHR0cHM6Ly9vYnNlcnZhdG9yaXVtLWFwaS1vcGVuLWNsdXN0ZXItbWFuYWdlbWVudC1vYnNlcnZhYmlsaXR5LmFwcHMuYWNtLWdpZ2FudGljLnJkdTIuc2NhbGVsYWIucmVkaGF0LmNvbS9hcGkvbWV0cmljcy92MS9kZWZhdWx0L2FwaS92MS9yZWNlaXZlCmFsZXJ0bWFuYWdlci1lbmRwb2ludDogIiIKYWxlcnRtYW5hZ2VyLXJvdXRlci1jYTogfAogIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogIE1JSURqekNDQW5lZ0F3SUJBZ0lJSzRJSUg0UURlR1l3RFFZSktvWklodmNOQVFFTEJRQXdKakVrTUNJR0ExVUUKICBBd3diYVc1bmNtVnpjeTF2Y0dWeVlYUnZja0F4TnpNd01qSTFORFUxTUI0WERUSTBNVEF5T1RFNE1UQTFORm9YCiAgRFRJMk1UQXlPVEU0TVRBMU5Wb3dOekUxTURNR0ExVUVBd3dzS2k1aGNIQnpMbUZqYlMxbmFXZGhiblJwWXk1eQogIFpIVXlMbk5qWVd4bGJHRmlMbkpsWkdoaGRDNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXcKICBnZ0VLQW9JQkFRQ2Jxb0hTanQyTktzcllrcldDN3hYWFROMnpKZ2lTMVVZNkhjSFNoN0dZZk91aFJDc3B6SFl5CiAgSHIxUGh1bzVrNTBxeERLL2sxQzFDSTY4bjVQNWFReGdsaVJQMlFXNjljSHlzUENaK215dGxZR2lTRmdtTWtuagogIEtPM1d6MVBiYm14K3llNXJ4azhYRHZIK2VtZnRBU0RrampUdVF3RlplV0NaWDFTbWprRXE2RnM0V2MyVXAra2wKICB5YkhHVXNzTnJGVDBxNnBuZG9jUDBmVTlhN3dodkFZMVJpdkdUZ3NVZjkzM2tneXhNMitkTzdsczkxM0VwbitMCiAgcFJrV1JlYW1JODZ3S3NIVjhwdWt0M2MycS84MFIzdEN5YXpjQSt3U0NXUEVySHpLVFhZWXBlMkE0K2hKaGs2dgogIGcxTU0yMTk2MnJsb05tLzNTcHc5cTdxNEJZV09HQWNkQWdNQkFBR2pnYTh3Z2F3d0RnWURWUjBQQVFIL0JBUUQKICBBZ1dnTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3SFFZRFZSME9CQllFCiAgRkoyU3NiWGx6anZZWEtjUEpxRUtaakI0UWpNZ01COEdBMVVkSXdRWU1CYUFGSWY1QzhXdTllSmxWTWdTcENCZQogIGwyb29YdmIzTURjR0ExVWRFUVF3TUM2Q0xDb3VZWEJ3Y3k1aFkyMHRaMmxuWVc1MGFXTXVjbVIxTWk1elkyRnMKICBaV3hoWWk1eVpXUm9ZWFF1WTI5dE1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQndicWhteDZaYzh5K3d3bWFVCiAgcnBvQXpMTmpJdE5UZkViQnJ5RWNpbDlnMm5IZ0NhTXFQd29pRVF2cjA2blRnVE41Rm16RlRPYkpJa1ZZOUJIRgogIGZpSWYxeG1JMWl6UENNUERjY3d4K0FaSG51ZW03bDNNWWloRVFGVEZsM0pSRmZIVVZ1TjhtQSt6dUZ3UXJlYW8KICBTSTZlZEdjNHRCd2FoRnRRQ0F5ZWtYQzlwVXEwUFBnSkx0bXVHV2t4M3ZjTncvYmhXQ0ZlRndlaVNKdTZLTmZ1CiAgR0RwbHZCbmt6UDhaNTB1UWg3ck1FSkFMSUdYQnNRV3p5Q2g5MXFjZXVReVZtN1FicW9SOXArQmRkV0cvZ1YydwogIG5iYWo2MzJaRE5RMVRJa3luQUdHTm1STEJ1Wm8xZnA0MHpwYnVkNHdzSnQwOWR4eGJ1ejFvd3VkRWdtUTBRd1gKICBMajVaCiAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogIE1JSURERENDQWZTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBREFtTVNRd0lnWURWUVFEREJ0cGJtZHkKICBaWE56TFc5d1pYSmhkRzl5UURFM016QXlNalUwTlRVd0hoY05NalF4TURJNU1UZ3hNRFUwV2hjTk1qWXhNREk1CiAgTVRneE1EVTFXakFtTVNRd0lnWURWUVFEREJ0cGJtZHlaWE56TFc5d1pYSmhkRzl5UURFM016QXlNalUwTlRVdwogIGdnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURaZjNWdjgrSWlITE5OcnBST3hYSkgKICBTMmpsS1RjTDBPeWQvQ1VDcVpWaW9mU1Y2V2dkblZ5R3dsbGVYY2JRQkgydmhmcDZzRS9IUlJwSmdSRkJCZTBpCiAgbkhTcklQb0k0RmlYTUE3ZFZkdlNUQUdwekFpSElpZkFGdStDaXgzcm8wN21xZm9sRitIUVN5MFJ1bVA4MzIwZwogIG1xREVGa25WMURVUmtvZUE2SnBzd3FrbEV0SnYvWWYwQTNDMmhqVXVtQVJ0ZGZmOWhjWS9tcjJ4UGJ3TWt6d2UKICAyZ2N0cy9qc0tPN1U5TCtKWWxQdmxIOThGdkc0Qnp3YWF1VEI5dDVsMCtYQzNrdzA1aC9iN0tINjBlOUJYWk1lCiAgd0tWMGNpVFFZdkc3S2JQMDJVZHNkYWtwbFN0eExsR0YyaHFBUTErV09GOWlINW9DYnhIY0NnOFkrTVdHUnZGUgogIEFnTUJBQUdqUlRCRE1BNEdBMVVkRHdFQi93UUVBd0lDcERBU0JnTlZIUk1CQWY4RUNEQUdBUUgvQWdFQU1CMEcKICBBMVVkRGdRV0JCU0grUXZGcnZYaVpWVElFcVFnWHBkcUtGNzI5ekFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBCiAgSnoxUzhkWGtHcTYrMy9rOHNHS2NKUkE4cUpqU0IxZllORlUzZUw1ekV4eUR3RDFLUWdkS0w2ZFIvcjNCcHhEZgogIFhBc0dteFJuZ2dXOTNXaysrZnJ1bC9RKzMxa0FYdWh0VW91NUx3SDE3ZXBNdXZ0ZExocFBPOWdCcy9PYytiSFAKICBWRGFDVGdpMklpZU1YbHVkNnJZV251VmNmUnRCSWFZNXFSK0tBcS9zR2VBcmNhS3VPQVhtdnlGbWRNTUI2S0VECiAgdlBzUThtU1h0c1pGdURaQ0gvMG9iR3pDNG5iTVFMUDFzQ2tHWThDZ29uZXJUSWRnck1JYk1veWhMZGxyRDFCVgogIERPZ1M3bmhTb1EwS2lHSy9Ha29lREdvSThLRlpvN2xYcmxzbkdMRkJzaDJ4ZVBURWlpZ1YzMVdLdHNoMnVyQmEKICBseFp1RUNOaE05UVRLVityVzh0M0hnPT0KICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
        kind: Secret
        metadata:
          name: hub-info-secret
          namespace: open-cluster-management-addon-observability
  status:
    conditions:
    - lastTransitionTime: "2024-10-30T04:02:47Z"
      message: Apply manifest work complete
      observedGeneration: 1
      reason: AppliedManifestWorkComplete
      status: "True"
      type: Applied
    - lastTransitionTime: "2024-10-30T04:02:48Z"
      message: All resources are available
      observedGeneration: 1
      reason: ResourcesAvailable
      status: "True"
      type: Available
    resourceStatus:
      manifests:
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:47Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:48Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:48Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: observability.open-cluster-management.io
          kind: ObservabilityAddon
          name: observability-addon
          namespace: open-cluster-management-addon-observability
          ordinal: 0
          resource: observabilityaddons
          version: v1beta1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Namespace
          name: open-cluster-management-addon-observability
          namespace: ""
          ordinal: 1
          resource: namespaces
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: observability-managed-cluster-certs
          namespace: open-cluster-management-addon-observability
          ordinal: 2
          resource: secrets
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: observability-alertmanager-accessor
          namespace: open-cluster-management-addon-observability
          ordinal: 3
          resource: secrets
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: aggregate-observabilityaddons-edit
          namespace: ""
          ordinal: 4
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRole
          name: open-cluster-management:endpoint-observability-operator
          namespace: ""
          ordinal: 5
          resource: clusterroles
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: rbac.authorization.k8s.io
          kind: ClusterRoleBinding
          name: open-cluster-management:endpoint-observability-operator-rb
          namespace: ""
          ordinal: 6
          resource: clusterrolebindings
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ServiceAccount
          name: endpoint-observability-operator-sa
          namespace: open-cluster-management-addon-observability
          ordinal: 7
          resource: serviceaccounts
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ConfigMap
          name: observability-metrics-allowlist
          namespace: open-cluster-management-addon-observability
          ordinal: 8
          resource: configmaps
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: observabilityaddons.observability.open-cluster-management.io
          namespace: ""
          ordinal: 9
          resource: customresourcedefinitions
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: apps
          kind: Deployment
          name: endpoint-observability-operator
          namespace: open-cluster-management-addon-observability
          ordinal: 10
          resource: deployments
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: multiclusterhub-operator-pull-secret
          namespace: open-cluster-management-addon-observability
          ordinal: 11
          resource: secrets
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: ConfigMap
          name: images-list
          namespace: open-cluster-management-addon-observability
          ordinal: 12
          resource: configmaps
          version: v1
        statusFeedback: {}
      - conditions:
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Apply manifest complete
          reason: AppliedManifestComplete
          status: "True"
          type: Applied
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: Resource is available
          reason: ResourceAvailable
          status: "True"
          type: Available
        - lastTransitionTime: "2024-10-30T04:02:45Z"
          message: ""
          reason: NoStatusFeedbackSynced
          status: "True"
          type: StatusFeedbackSynced
        resourceMeta:
          group: ""
          kind: Secret
          name: hub-info-secret
          namespace: open-cluster-management-addon-observability
          ordinal: 13
          resource: secrets
          version: v1
        statusFeedback: {}
kind: List
metadata:
  resourceVersion: ""
