containers:
  - env:
      - name: SYSTEM_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: METRICS_DOMAIN
        value: tekton.dev/chains
      - name: CONFIG_OBSERVABILITY_NAME
        value: tekton-chains-config-observability
      - name: CONFIG_LEADERELECTION_NAME
        value: tekton-chains-config-leader-election
      - name: KUBERNETES_MIN_VERSION
        value: v1.0.0
      - name: STATEFUL_SERVICE_NAME
        value: tekton-chains-controller
      - name: STATEFUL_CONTROLLER_ORDINAL
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: SSL_CERT_DIR
        value: /tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs
    image: quay.io/openshift-pipeline/pipelines-chains-controller-rhel9@sha256:8cdb90416bd937366ee66fb2eef8551f257c68d8446a3d4da3a38b768df93d7d
    imagePullPolicy: IfNotPresent
    name: tekton-chains-controller
    ports:
      - containerPort: 9090
        name: metrics
        protocol: TCP
    resources: {}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      readOnlyRootFilesystem: true
      runAsUser: 1000790000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
      - mountPath: /etc/signing-secrets
        name: signing-secrets
      - mountPath: /var/run/sigstore/cosign
        name: oidc-info
      - mountPath: /tekton-custom-certs/ca-bundle.crt
        name: config-trusted-cabundle-volume
        readOnly: true
        subPath: ca-bundle.crt
      - mountPath: /tekton-custom-certs/service-ca.crt
        name: config-service-cabundle-volume
        readOnly: true
        subPath: service-ca.crt
      - mountPath: /etc/pki/ca-trust/extracted/pem
        name: config-trusted-system-cabundle-volume
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-fkmmv
        readOnly: true
dnsPolicy: ClusterFirst
enableServiceLinks: true
hostname: tekton-chains-controller-0
imagePullSecrets:
  - name: tekton-chains-controller-dockercfg-ccdtq
nodeName: hive4-pvmdf-worker-0-dp9rd
preemptionPolicy: PreemptLowerPriority
priority: 0
restartPolicy: Always
schedulerName: default-scheduler
securityContext:
  fsGroup: 1000790000
  runAsNonRoot: true
  seLinuxOptions:
    level: s0:c28,c17
  seccompProfile:
    type: RuntimeDefault
serviceAccount: tekton-chains-controller
serviceAccountName: tekton-chains-controller
subdomain: tekton-chains-controller
terminationGracePeriodSeconds: 30
tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
volumes:
  - name: signing-secrets
    secret:
      defaultMode: 420
      secretName: signing-secrets
  - name: oidc-info
    projected:
      defaultMode: 420
      sources:
        - serviceAccountToken:
            audience: sigstore
            expirationSeconds: 600
            path: oidc-token
  - configMap:
      defaultMode: 420
      items:
        - key: ca-bundle.crt
          path: ca-bundle.crt
      name: config-trusted-cabundle
    name: config-trusted-cabundle-volume
  - configMap:
      defaultMode: 420
      items:
        - key: service-ca.crt
          path: service-ca.crt
      name: config-service-cabundle
    name: config-service-cabundle-volume
  - configMap:
      defaultMode: 420
      items:
        - key: ca-bundle.crt
          path: tls-ca-bundle.pem
      name: config-trusted-cabundle
    name: config-trusted-system-cabundle-volume
  - name: kube-api-access-fkmmv
    projected:
      defaultMode: 420
      sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
              - key: ca.crt
                path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
                path: namespace
        - configMap:
            items:
              - key: service-ca.crt
                path: service-ca.crt
            name: openshift-service-ca.crt
