---
apiVersion: v1
kind: Pod
metadata:
  annotations:
    openshift.io/required-scc: hostnetwork-v2
    openshift.io/scc: hostnetwork-v2
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
  creationTimestamp: "2025-10-27T11:30:08Z"
  generateName: network-node-identity-
  labels:
    app: network-node-identity
    component: network
    controller-revision-hash: 8c6446554
    kubernetes.io/os: linux
    openshift.io/component: network
    pod-template-generation: "1"
    type: infra
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:openshift.io/required-scc: {}
          f:target.workload.openshift.io/management: {}
        f:generateName: {}
        f:labels:
          .: {}
          f:app: {}
          f:component: {}
          f:controller-revision-hash: {}
          f:kubernetes.io/os: {}
          f:openshift.io/component: {}
          f:pod-template-generation: {}
          f:type: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"88d0f249-503b-49ca-a859-645b2ff6757a"}: {}
      f:spec:
        f:affinity:
          .: {}
          f:nodeAffinity:
            .: {}
            f:requiredDuringSchedulingIgnoredDuringExecution: {}
        f:containers:
          k:{"name":"approver"}:
            .: {}
            f:command: {}
            f:env:
              .: {}
              k:{"name":"LOGLEVEL"}:
                .: {}
                f:name: {}
                f:value: {}
            f:image: {}
            f:imagePullPolicy: {}
            f:name: {}
            f:resources:
              .: {}
              f:requests:
                .: {}
                f:cpu: {}
                f:memory: {}
            f:terminationMessagePath: {}
            f:terminationMessagePolicy: {}
            f:volumeMounts:
              .: {}
              k:{"mountPath":"/env"}:
                .: {}
                f:mountPath: {}
                f:name: {}
              k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                .: {}
                f:mountPath: {}
                f:name: {}
          k:{"name":"webhook"}:
            .: {}
            f:command: {}
            f:env:
              .: {}
              k:{"name":"KUBERNETES_NODE_NAME"}:
                .: {}
                f:name: {}
                f:valueFrom:
                  .: {}
                  f:fieldRef: {}
              k:{"name":"LOGLEVEL"}:
                .: {}
                f:name: {}
                f:value: {}
            f:image: {}
            f:imagePullPolicy: {}
            f:name: {}
            f:resources:
              .: {}
              f:requests:
                .: {}
                f:cpu: {}
                f:memory: {}
            f:terminationMessagePath: {}
            f:terminationMessagePolicy: {}
            f:volumeMounts:
              .: {}
              k:{"mountPath":"/env"}:
                .: {}
                f:mountPath: {}
                f:name: {}
              k:{"mountPath":"/etc/webhook-cert/"}:
                .: {}
                f:mountPath: {}
                f:name: {}
              k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                .: {}
                f:mountPath: {}
                f:name: {}
        f:dnsPolicy: {}
        f:enableServiceLinks: {}
        f:hostNetwork: {}
        f:nodeSelector: {}
        f:priorityClassName: {}
        f:restartPolicy: {}
        f:schedulerName: {}
        f:securityContext: {}
        f:serviceAccount: {}
        f:serviceAccountName: {}
        f:terminationGracePeriodSeconds: {}
        f:tolerations: {}
        f:volumes:
          .: {}
          k:{"name":"env-overrides"}:
            .: {}
            f:configMap:
              .: {}
              f:defaultMode: {}
              f:name: {}
              f:optional: {}
            f:name: {}
          k:{"name":"ovnkube-identity-cm"}:
            .: {}
            f:configMap:
              .: {}
              f:defaultMode: {}
              f:items: {}
              f:name: {}
            f:name: {}
          k:{"name":"webhook-cert"}:
            .: {}
            f:name: {}
            f:secret:
              .: {}
              f:defaultMode: {}
              f:secretName: {}
    manager: kube-controller-manager
    operation: Update
    time: "2025-10-27T11:30:08Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:conditions:
          k:{"type":"ContainersReady"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:status: {}
            f:type: {}
          k:{"type":"Initialized"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:status: {}
            f:type: {}
          k:{"type":"PodReadyToStartContainers"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:status: {}
            f:type: {}
          k:{"type":"Ready"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:status: {}
            f:type: {}
        f:containerStatuses: {}
        f:hostIP: {}
        f:hostIPs: {}
        f:phase: {}
        f:podIP: {}
        f:podIPs:
          .: {}
          k:{"ip":"10.46.248.134"}:
            .: {}
            f:ip: {}
          k:{"ip":"2620:52:0:2ef8::86"}:
            .: {}
            f:ip: {}
        f:startTime: {}
    manager: kubelet
    operation: Update
    subresource: status
    time: "2025-10-27T12:37:20Z"
  name: network-node-identity-tnp5k
  namespace: openshift-network-node-identity
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: DaemonSet
    name: network-node-identity
    uid: 88d0f249-503b-49ca-a859-645b2ff6757a
  resourceVersion: "48540"
  uid: 8f079307-7b61-48fa-80ec-6fb927c0407d
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchFields:
          - key: metadata.name
            operator: In
            values:
            - cnvqe-072.lab.eng.tlv2.redhat.com
  containers:
  - command:
    - /bin/bash
    - -c
    - |
      set -xe
      if [[ -f "/env/_master" ]]; then
        set -o allexport
        source "/env/_master"
        set +o allexport
      fi
      # OVN-K will try to remove hybrid overlay node annotations even when the hybrid overlay is not enabled.
      # https://github.com/ovn-org/ovn-kubernetes/blob/ac6820df0b338a246f10f412cd5ec903bd234694/go-controller/pkg/ovn/master.go#L791
      ho_enable="--enable-hybrid-overlay"
      echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start webhook"
      # extra-allowed-user: service account `ovn-kubernetes-control-plane`
      # sets pod annotations in multi-homing layer3 network controller (cluster-manager)
      exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
          --webhook-cert-dir="/etc/webhook-cert" \
          --webhook-host=127.0.0.1 \
          --webhook-port=9743 \
          ${ho_enable} \
          --enable-interconnect \
          --disable-approver \
          --extra-allowed-user="system:serviceaccount:openshift-ovn-kubernetes:ovn-kubernetes-control-plane" \
          --wait-for-kubernetes-api=200s \
          --pod-admission-conditions="/var/run/ovnkube-identity-config/additional-pod-admission-cond.json" \
          --loglevel="${LOGLEVEL}"
    env:
    - name: LOGLEVEL
      value: "2"
    - name: KUBERNETES_NODE_NAME
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: spec.nodeName
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
    imagePullPolicy: IfNotPresent
    name: webhook
    resources:
      requests:
        cpu: 10m
        memory: 50Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1000550000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/webhook-cert/
      name: webhook-cert
    - mountPath: /env
      name: env-overrides
    - mountPath: /var/run/ovnkube-identity-config
      name: ovnkube-identity-cm
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-m6hcm
      readOnly: true
  - command:
    - /bin/bash
    - -c
    - |
      set -xe
      if [[ -f "/env/_master" ]]; then
        set -o allexport
        source "/env/_master"
        set +o allexport
      fi

      echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start approver"
      exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
          --disable-webhook \
          --csr-acceptance-conditions="/var/run/ovnkube-identity-config/additional-cert-acceptance-cond.json" \
          --loglevel="${LOGLEVEL}"
    env:
    - name: LOGLEVEL
      value: "4"
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
    imagePullPolicy: IfNotPresent
    name: approver
    resources:
      requests:
        cpu: 10m
        memory: 50Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1000550000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /env
      name: env-overrides
    - mountPath: /var/run/ovnkube-identity-config
      name: ovnkube-identity-cm
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-m6hcm
      readOnly: true
  dnsPolicy: Default
  enableServiceLinks: true
  hostNetwork: true
  nodeName: cnvqe-072.lab.eng.tlv2.redhat.com
  nodeSelector:
    beta.kubernetes.io/os: linux
    node-role.kubernetes.io/master: ""
  preemptionPolicy: PreemptLowerPriority
  priority: 2000001000
  priorityClassName: system-node-critical
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1000550000
    seLinuxOptions:
      level: s0:c23,c22
    seccompProfile:
      type: RuntimeDefault
    supplementalGroups:
    - 1000550000
  serviceAccount: network-node-identity
  serviceAccountName: network-node-identity
  terminationGracePeriodSeconds: 200
  tolerations:
  - operator: Exists
  volumes:
  - name: webhook-cert
    secret:
      defaultMode: 420
      secretName: network-node-identity-cert
  - configMap:
      defaultMode: 420
      name: env-overrides
      optional: true
    name: env-overrides
  - configMap:
      defaultMode: 420
      items:
      - key: additional-cert-acceptance-cond.json
        path: additional-cert-acceptance-cond.json
      - key: additional-pod-admission-cond.json
        path: additional-pod-admission-cond.json
      name: ovnkube-identity-cm
    name: ovnkube-identity-cm
  - name: kube-api-access-m6hcm
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
      - configMap:
          items:
          - key: service-ca.crt
            path: service-ca.crt
          name: openshift-service-ca.crt
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T12:37:20Z"
    status: "True"
    type: PodReadyToStartContainers
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T11:30:08Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T12:37:20Z"
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T12:37:20Z"
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T11:30:08Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: cri-o://6cb519582cb5b1eb4f9173457c5caa7d0cf8845003e65f9103870a98e4d78956
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
    imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
    lastState: {}
    name: approver
    ready: true
    restartCount: 1
    started: true
    state:
      running:
        startedAt: "2025-10-27T12:37:19Z"
    volumeMounts:
    - mountPath: /env
      name: env-overrides
    - mountPath: /var/run/ovnkube-identity-config
      name: ovnkube-identity-cm
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-m6hcm
      readOnly: true
      recursiveReadOnly: Disabled
  - containerID: cri-o://85a7c174d02f0cfa4ddf6747c4b98202ac2204531fda172aebb5b44f90fb655b
    image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
    imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
    lastState: {}
    name: webhook
    ready: true
    restartCount: 1
    started: true
    state:
      running:
        startedAt: "2025-10-27T12:37:16Z"
    volumeMounts:
    - mountPath: /etc/webhook-cert/
      name: webhook-cert
    - mountPath: /env
      name: env-overrides
    - mountPath: /var/run/ovnkube-identity-config
      name: ovnkube-identity-cm
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-m6hcm
      readOnly: true
      recursiveReadOnly: Disabled
  hostIP: 10.46.248.134
  hostIPs:
  - ip: 10.46.248.134
  - ip: 2620:52:0:2ef8::86
  phase: Running
  podIP: 10.46.248.134
  podIPs:
  - ip: 10.46.248.134
  - ip: 2620:52:0:2ef8::86
  qosClass: Burstable
  startTime: "2025-10-27T11:30:08Z"
