---
apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      openshift.io/required-scc: hostnetwork-v2
      openshift.io/scc: hostnetwork-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
    creationTimestamp: "2025-10-27T11:30:08Z"
    generateName: network-node-identity-
    labels:
      app: network-node-identity
      component: network
      controller-revision-hash: 8c6446554
      kubernetes.io/os: linux
      openshift.io/component: network
      pod-template-generation: "1"
      type: infra
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:openshift.io/required-scc: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:component: {}
            f:controller-revision-hash: {}
            f:kubernetes.io/os: {}
            f:openshift.io/component: {}
            f:pod-template-generation: {}
            f:type: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"88d0f249-503b-49ca-a859-645b2ff6757a"}: {}
        f:spec:
          f:affinity:
            .: {}
            f:nodeAffinity:
              .: {}
              f:requiredDuringSchedulingIgnoredDuringExecution: {}
          f:containers:
            k:{"name":"approver"}:
              .: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"LOGLEVEL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/env"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
            k:{"name":"webhook"}:
              .: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"KUBERNETES_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"LOGLEVEL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/env"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/webhook-cert/"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:hostNetwork: {}
          f:nodeSelector: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:volumes:
            .: {}
            k:{"name":"env-overrides"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"ovnkube-identity-cm"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:items: {}
                f:name: {}
              f:name: {}
            k:{"name":"webhook-cert"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-27T11:30:08Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.46.248.42"}:
              .: {}
              f:ip: {}
            k:{"ip":"2620:52:0:2ef8::2a"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2025-10-27T12:17:12Z"
    name: network-node-identity-fzsz9
    namespace: openshift-network-node-identity
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: DaemonSet
      name: network-node-identity
      uid: 88d0f249-503b-49ca-a859-645b2ff6757a
    resourceVersion: "37179"
    uid: b6540223-8230-4ba1-904d-a906c48cfa28
  spec:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchFields:
            - key: metadata.name
              operator: In
              values:
              - cnvqe-071.lab.eng.tlv2.redhat.com
    containers:
    - command:
      - /bin/bash
      - -c
      - |
        set -xe
        if [[ -f "/env/_master" ]]; then
          set -o allexport
          source "/env/_master"
          set +o allexport
        fi
        # OVN-K will try to remove hybrid overlay node annotations even when the hybrid overlay is not enabled.
        # https://github.com/ovn-org/ovn-kubernetes/blob/ac6820df0b338a246f10f412cd5ec903bd234694/go-controller/pkg/ovn/master.go#L791
        ho_enable="--enable-hybrid-overlay"
        echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start webhook"
        # extra-allowed-user: service account `ovn-kubernetes-control-plane`
        # sets pod annotations in multi-homing layer3 network controller (cluster-manager)
        exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
            --webhook-cert-dir="/etc/webhook-cert" \
            --webhook-host=127.0.0.1 \
            --webhook-port=9743 \
            ${ho_enable} \
            --enable-interconnect \
            --disable-approver \
            --extra-allowed-user="system:serviceaccount:openshift-ovn-kubernetes:ovn-kubernetes-control-plane" \
            --wait-for-kubernetes-api=200s \
            --pod-admission-conditions="/var/run/ovnkube-identity-config/additional-pod-admission-cond.json" \
            --loglevel="${LOGLEVEL}"
      env:
      - name: LOGLEVEL
        value: "2"
      - name: KUBERNETES_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imagePullPolicy: IfNotPresent
      name: webhook
      resources:
        requests:
          cpu: 10m
          memory: 50Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        runAsNonRoot: true
        runAsUser: 1000550000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /etc/webhook-cert/
        name: webhook-cert
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dl7h5
        readOnly: true
    - command:
      - /bin/bash
      - -c
      - |
        set -xe
        if [[ -f "/env/_master" ]]; then
          set -o allexport
          source "/env/_master"
          set +o allexport
        fi

        echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start approver"
        exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
            --disable-webhook \
            --csr-acceptance-conditions="/var/run/ovnkube-identity-config/additional-cert-acceptance-cond.json" \
            --loglevel="${LOGLEVEL}"
      env:
      - name: LOGLEVEL
        value: "4"
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imagePullPolicy: IfNotPresent
      name: approver
      resources:
        requests:
          cpu: 10m
          memory: 50Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        runAsNonRoot: true
        runAsUser: 1000550000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dl7h5
        readOnly: true
    dnsPolicy: Default
    enableServiceLinks: true
    hostNetwork: true
    nodeName: cnvqe-071.lab.eng.tlv2.redhat.com
    nodeSelector:
      beta.kubernetes.io/os: linux
      node-role.kubernetes.io/master: ""
    preemptionPolicy: PreemptLowerPriority
    priority: 2000001000
    priorityClassName: system-node-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000550000
      seLinuxOptions:
        level: s0:c23,c22
      seccompProfile:
        type: RuntimeDefault
      supplementalGroups:
      - 1000550000
    serviceAccount: network-node-identity
    serviceAccountName: network-node-identity
    terminationGracePeriodSeconds: 200
    tolerations:
    - operator: Exists
    volumes:
    - name: webhook-cert
      secret:
        defaultMode: 420
        secretName: network-node-identity-cert
    - configMap:
        defaultMode: 420
        name: env-overrides
        optional: true
      name: env-overrides
    - configMap:
        defaultMode: 420
        items:
        - key: additional-cert-acceptance-cond.json
          path: additional-cert-acceptance-cond.json
        - key: additional-pod-admission-cond.json
          path: additional-pod-admission-cond.json
        name: ovnkube-identity-cm
      name: ovnkube-identity-cm
    - name: kube-api-access-dl7h5
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:17:12Z"
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T11:30:08Z"
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:17:12Z"
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:17:12Z"
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T11:30:08Z"
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://758802915a25a8161977be1b9887adfe28900d8e0873a8ce8593f3ffa5873fe4
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      lastState: {}
      name: approver
      ready: true
      restartCount: 1
      started: true
      state:
        running:
          startedAt: "2025-10-27T12:17:12Z"
      volumeMounts:
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dl7h5
        readOnly: true
        recursiveReadOnly: Disabled
    - containerID: cri-o://1cc2b4e413da42e3ed890996739b819918d76b0ce5dd6236406cfa2bdc1fa0d3
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      lastState: {}
      name: webhook
      ready: true
      restartCount: 1
      started: true
      state:
        running:
          startedAt: "2025-10-27T12:17:10Z"
      volumeMounts:
      - mountPath: /etc/webhook-cert/
        name: webhook-cert
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-dl7h5
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.46.248.42
    hostIPs:
    - ip: 10.46.248.42
    - ip: 2620:52:0:2ef8::2a
    phase: Running
    podIP: 10.46.248.42
    podIPs:
    - ip: 10.46.248.42
    - ip: 2620:52:0:2ef8::2a
    qosClass: Burstable
    startTime: "2025-10-27T11:30:08Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      openshift.io/required-scc: hostnetwork-v2
      openshift.io/scc: hostnetwork-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
    creationTimestamp: "2025-10-27T11:49:11Z"
    generateName: network-node-identity-
    labels:
      app: network-node-identity
      component: network
      controller-revision-hash: 8c6446554
      kubernetes.io/os: linux
      openshift.io/component: network
      pod-template-generation: "1"
      type: infra
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:openshift.io/required-scc: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:component: {}
            f:controller-revision-hash: {}
            f:kubernetes.io/os: {}
            f:openshift.io/component: {}
            f:pod-template-generation: {}
            f:type: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"88d0f249-503b-49ca-a859-645b2ff6757a"}: {}
        f:spec:
          f:affinity:
            .: {}
            f:nodeAffinity:
              .: {}
              f:requiredDuringSchedulingIgnoredDuringExecution: {}
          f:containers:
            k:{"name":"approver"}:
              .: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"LOGLEVEL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/env"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
            k:{"name":"webhook"}:
              .: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"KUBERNETES_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"LOGLEVEL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/env"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/webhook-cert/"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:hostNetwork: {}
          f:nodeSelector: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:volumes:
            .: {}
            k:{"name":"env-overrides"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"ovnkube-identity-cm"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:items: {}
                f:name: {}
              f:name: {}
            k:{"name":"webhook-cert"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-27T11:49:11Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.46.248.41"}:
              .: {}
              f:ip: {}
            k:{"ip":"2620:52:0:2ef8::29"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2025-10-27T12:27:19Z"
    name: network-node-identity-qrr59
    namespace: openshift-network-node-identity
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: DaemonSet
      name: network-node-identity
      uid: 88d0f249-503b-49ca-a859-645b2ff6757a
    resourceVersion: "42491"
    uid: 3f1fbea3-5a62-4e36-ba55-37bf08c5b0c4
  spec:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchFields:
            - key: metadata.name
              operator: In
              values:
              - cnvqe-070.lab.eng.tlv2.redhat.com
    containers:
    - command:
      - /bin/bash
      - -c
      - |
        set -xe
        if [[ -f "/env/_master" ]]; then
          set -o allexport
          source "/env/_master"
          set +o allexport
        fi
        # OVN-K will try to remove hybrid overlay node annotations even when the hybrid overlay is not enabled.
        # https://github.com/ovn-org/ovn-kubernetes/blob/ac6820df0b338a246f10f412cd5ec903bd234694/go-controller/pkg/ovn/master.go#L791
        ho_enable="--enable-hybrid-overlay"
        echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start webhook"
        # extra-allowed-user: service account `ovn-kubernetes-control-plane`
        # sets pod annotations in multi-homing layer3 network controller (cluster-manager)
        exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
            --webhook-cert-dir="/etc/webhook-cert" \
            --webhook-host=127.0.0.1 \
            --webhook-port=9743 \
            ${ho_enable} \
            --enable-interconnect \
            --disable-approver \
            --extra-allowed-user="system:serviceaccount:openshift-ovn-kubernetes:ovn-kubernetes-control-plane" \
            --wait-for-kubernetes-api=200s \
            --pod-admission-conditions="/var/run/ovnkube-identity-config/additional-pod-admission-cond.json" \
            --loglevel="${LOGLEVEL}"
      env:
      - name: LOGLEVEL
        value: "2"
      - name: KUBERNETES_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imagePullPolicy: IfNotPresent
      name: webhook
      resources:
        requests:
          cpu: 10m
          memory: 50Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        runAsNonRoot: true
        runAsUser: 1000550000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /etc/webhook-cert/
        name: webhook-cert
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zr9gv
        readOnly: true
    - command:
      - /bin/bash
      - -c
      - |
        set -xe
        if [[ -f "/env/_master" ]]; then
          set -o allexport
          source "/env/_master"
          set +o allexport
        fi

        echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start approver"
        exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
            --disable-webhook \
            --csr-acceptance-conditions="/var/run/ovnkube-identity-config/additional-cert-acceptance-cond.json" \
            --loglevel="${LOGLEVEL}"
      env:
      - name: LOGLEVEL
        value: "4"
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imagePullPolicy: IfNotPresent
      name: approver
      resources:
        requests:
          cpu: 10m
          memory: 50Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        runAsNonRoot: true
        runAsUser: 1000550000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zr9gv
        readOnly: true
    dnsPolicy: Default
    enableServiceLinks: true
    hostNetwork: true
    imagePullSecrets:
    - name: network-node-identity-dockercfg-ltcph
    nodeName: cnvqe-070.lab.eng.tlv2.redhat.com
    nodeSelector:
      beta.kubernetes.io/os: linux
      node-role.kubernetes.io/master: ""
    preemptionPolicy: PreemptLowerPriority
    priority: 2000001000
    priorityClassName: system-node-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000550000
      seLinuxOptions:
        level: s0:c23,c22
      seccompProfile:
        type: RuntimeDefault
      supplementalGroups:
      - 1000550000
    serviceAccount: network-node-identity
    serviceAccountName: network-node-identity
    terminationGracePeriodSeconds: 200
    tolerations:
    - operator: Exists
    volumes:
    - name: webhook-cert
      secret:
        defaultMode: 420
        secretName: network-node-identity-cert
    - configMap:
        defaultMode: 420
        name: env-overrides
        optional: true
      name: env-overrides
    - configMap:
        defaultMode: 420
        items:
        - key: additional-cert-acceptance-cond.json
          path: additional-cert-acceptance-cond.json
        - key: additional-pod-admission-cond.json
          path: additional-pod-admission-cond.json
        name: ovnkube-identity-cm
      name: ovnkube-identity-cm
    - name: kube-api-access-zr9gv
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:27:19Z"
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T11:49:11Z"
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:27:19Z"
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:27:19Z"
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T11:49:11Z"
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://3ea2f0ff978513e1514454f7895fa2f97b835dfdec51ba9cb43b0e8061aa53e1
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      lastState: {}
      name: approver
      ready: true
      restartCount: 1
      started: true
      state:
        running:
          startedAt: "2025-10-27T12:27:18Z"
      volumeMounts:
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zr9gv
        readOnly: true
        recursiveReadOnly: Disabled
    - containerID: cri-o://524cb0f24fbe4456876dc8bf828fd853885b7adf9c2779e09b9da72fa4117d14
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      lastState: {}
      name: webhook
      ready: true
      restartCount: 1
      started: true
      state:
        running:
          startedAt: "2025-10-27T12:27:15Z"
      volumeMounts:
      - mountPath: /etc/webhook-cert/
        name: webhook-cert
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-zr9gv
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.46.248.41
    hostIPs:
    - ip: 10.46.248.41
    - ip: 2620:52:0:2ef8::29
    phase: Running
    podIP: 10.46.248.41
    podIPs:
    - ip: 10.46.248.41
    - ip: 2620:52:0:2ef8::29
    qosClass: Burstable
    startTime: "2025-10-27T11:49:11Z"
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      openshift.io/required-scc: hostnetwork-v2
      openshift.io/scc: hostnetwork-v2
      seccomp.security.alpha.kubernetes.io/pod: runtime/default
    creationTimestamp: "2025-10-27T11:30:08Z"
    generateName: network-node-identity-
    labels:
      app: network-node-identity
      component: network
      controller-revision-hash: 8c6446554
      kubernetes.io/os: linux
      openshift.io/component: network
      pod-template-generation: "1"
      type: infra
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:openshift.io/required-scc: {}
            f:target.workload.openshift.io/management: {}
          f:generateName: {}
          f:labels:
            .: {}
            f:app: {}
            f:component: {}
            f:controller-revision-hash: {}
            f:kubernetes.io/os: {}
            f:openshift.io/component: {}
            f:pod-template-generation: {}
            f:type: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"88d0f249-503b-49ca-a859-645b2ff6757a"}: {}
        f:spec:
          f:affinity:
            .: {}
            f:nodeAffinity:
              .: {}
              f:requiredDuringSchedulingIgnoredDuringExecution: {}
          f:containers:
            k:{"name":"approver"}:
              .: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"LOGLEVEL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/env"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
            k:{"name":"webhook"}:
              .: {}
              f:command: {}
              f:env:
                .: {}
                k:{"name":"KUBERNETES_NODE_NAME"}:
                  .: {}
                  f:name: {}
                  f:valueFrom:
                    .: {}
                    f:fieldRef: {}
                k:{"name":"LOGLEVEL"}:
                  .: {}
                  f:name: {}
                  f:value: {}
              f:image: {}
              f:imagePullPolicy: {}
              f:name: {}
              f:resources:
                .: {}
                f:requests:
                  .: {}
                  f:cpu: {}
                  f:memory: {}
              f:terminationMessagePath: {}
              f:terminationMessagePolicy: {}
              f:volumeMounts:
                .: {}
                k:{"mountPath":"/env"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/etc/webhook-cert/"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
                k:{"mountPath":"/var/run/ovnkube-identity-config"}:
                  .: {}
                  f:mountPath: {}
                  f:name: {}
          f:dnsPolicy: {}
          f:enableServiceLinks: {}
          f:hostNetwork: {}
          f:nodeSelector: {}
          f:priorityClassName: {}
          f:restartPolicy: {}
          f:schedulerName: {}
          f:securityContext: {}
          f:serviceAccount: {}
          f:serviceAccountName: {}
          f:terminationGracePeriodSeconds: {}
          f:tolerations: {}
          f:volumes:
            .: {}
            k:{"name":"env-overrides"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:name: {}
                f:optional: {}
              f:name: {}
            k:{"name":"ovnkube-identity-cm"}:
              .: {}
              f:configMap:
                .: {}
                f:defaultMode: {}
                f:items: {}
                f:name: {}
              f:name: {}
            k:{"name":"webhook-cert"}:
              .: {}
              f:name: {}
              f:secret:
                .: {}
                f:defaultMode: {}
                f:secretName: {}
      manager: kube-controller-manager
      operation: Update
      time: "2025-10-27T11:30:08Z"
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:conditions:
            k:{"type":"ContainersReady"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Initialized"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"PodReadyToStartContainers"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
            k:{"type":"Ready"}:
              .: {}
              f:lastProbeTime: {}
              f:lastTransitionTime: {}
              f:status: {}
              f:type: {}
          f:containerStatuses: {}
          f:hostIP: {}
          f:hostIPs: {}
          f:phase: {}
          f:podIP: {}
          f:podIPs:
            .: {}
            k:{"ip":"10.46.248.134"}:
              .: {}
              f:ip: {}
            k:{"ip":"2620:52:0:2ef8::86"}:
              .: {}
              f:ip: {}
          f:startTime: {}
      manager: kubelet
      operation: Update
      subresource: status
      time: "2025-10-27T12:37:20Z"
    name: network-node-identity-tnp5k
    namespace: openshift-network-node-identity
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: DaemonSet
      name: network-node-identity
      uid: 88d0f249-503b-49ca-a859-645b2ff6757a
    resourceVersion: "48540"
    uid: 8f079307-7b61-48fa-80ec-6fb927c0407d
  spec:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchFields:
            - key: metadata.name
              operator: In
              values:
              - cnvqe-072.lab.eng.tlv2.redhat.com
    containers:
    - command:
      - /bin/bash
      - -c
      - |
        set -xe
        if [[ -f "/env/_master" ]]; then
          set -o allexport
          source "/env/_master"
          set +o allexport
        fi
        # OVN-K will try to remove hybrid overlay node annotations even when the hybrid overlay is not enabled.
        # https://github.com/ovn-org/ovn-kubernetes/blob/ac6820df0b338a246f10f412cd5ec903bd234694/go-controller/pkg/ovn/master.go#L791
        ho_enable="--enable-hybrid-overlay"
        echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start webhook"
        # extra-allowed-user: service account `ovn-kubernetes-control-plane`
        # sets pod annotations in multi-homing layer3 network controller (cluster-manager)
        exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
            --webhook-cert-dir="/etc/webhook-cert" \
            --webhook-host=127.0.0.1 \
            --webhook-port=9743 \
            ${ho_enable} \
            --enable-interconnect \
            --disable-approver \
            --extra-allowed-user="system:serviceaccount:openshift-ovn-kubernetes:ovn-kubernetes-control-plane" \
            --wait-for-kubernetes-api=200s \
            --pod-admission-conditions="/var/run/ovnkube-identity-config/additional-pod-admission-cond.json" \
            --loglevel="${LOGLEVEL}"
      env:
      - name: LOGLEVEL
        value: "2"
      - name: KUBERNETES_NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imagePullPolicy: IfNotPresent
      name: webhook
      resources:
        requests:
          cpu: 10m
          memory: 50Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        runAsNonRoot: true
        runAsUser: 1000550000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /etc/webhook-cert/
        name: webhook-cert
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m6hcm
        readOnly: true
    - command:
      - /bin/bash
      - -c
      - |
        set -xe
        if [[ -f "/env/_master" ]]; then
          set -o allexport
          source "/env/_master"
          set +o allexport
        fi

        echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start approver"
        exec /usr/bin/ovnkube-identity  --k8s-apiserver=https://api-int.bm12b-tlv2.abi.cnv-qe.rhood.us:6443 \
            --disable-webhook \
            --csr-acceptance-conditions="/var/run/ovnkube-identity-config/additional-cert-acceptance-cond.json" \
            --loglevel="${LOGLEVEL}"
      env:
      - name: LOGLEVEL
        value: "4"
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imagePullPolicy: IfNotPresent
      name: approver
      resources:
        requests:
          cpu: 10m
          memory: 50Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        runAsNonRoot: true
        runAsUser: 1000550000
      terminationMessagePath: /dev/termination-log
      terminationMessagePolicy: FallbackToLogsOnError
      volumeMounts:
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m6hcm
        readOnly: true
    dnsPolicy: Default
    enableServiceLinks: true
    hostNetwork: true
    nodeName: cnvqe-072.lab.eng.tlv2.redhat.com
    nodeSelector:
      beta.kubernetes.io/os: linux
      node-role.kubernetes.io/master: ""
    preemptionPolicy: PreemptLowerPriority
    priority: 2000001000
    priorityClassName: system-node-critical
    restartPolicy: Always
    schedulerName: default-scheduler
    securityContext:
      fsGroup: 1000550000
      seLinuxOptions:
        level: s0:c23,c22
      seccompProfile:
        type: RuntimeDefault
      supplementalGroups:
      - 1000550000
    serviceAccount: network-node-identity
    serviceAccountName: network-node-identity
    terminationGracePeriodSeconds: 200
    tolerations:
    - operator: Exists
    volumes:
    - name: webhook-cert
      secret:
        defaultMode: 420
        secretName: network-node-identity-cert
    - configMap:
        defaultMode: 420
        name: env-overrides
        optional: true
      name: env-overrides
    - configMap:
        defaultMode: 420
        items:
        - key: additional-cert-acceptance-cond.json
          path: additional-cert-acceptance-cond.json
        - key: additional-pod-admission-cond.json
          path: additional-pod-admission-cond.json
        name: ovnkube-identity-cm
      name: ovnkube-identity-cm
    - name: kube-api-access-m6hcm
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            items:
            - key: ca.crt
              path: ca.crt
            name: kube-root-ca.crt
        - downwardAPI:
            items:
            - fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
              path: namespace
        - configMap:
            items:
            - key: service-ca.crt
              path: service-ca.crt
            name: openshift-service-ca.crt
  status:
    conditions:
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:37:20Z"
      status: "True"
      type: PodReadyToStartContainers
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T11:30:08Z"
      status: "True"
      type: Initialized
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:37:20Z"
      status: "True"
      type: Ready
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T12:37:20Z"
      status: "True"
      type: ContainersReady
    - lastProbeTime: null
      lastTransitionTime: "2025-10-27T11:30:08Z"
      status: "True"
      type: PodScheduled
    containerStatuses:
    - containerID: cri-o://6cb519582cb5b1eb4f9173457c5caa7d0cf8845003e65f9103870a98e4d78956
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      lastState: {}
      name: approver
      ready: true
      restartCount: 1
      started: true
      state:
        running:
          startedAt: "2025-10-27T12:37:19Z"
      volumeMounts:
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m6hcm
        readOnly: true
        recursiveReadOnly: Disabled
    - containerID: cri-o://85a7c174d02f0cfa4ddf6747c4b98202ac2204531fda172aebb5b44f90fb655b
      image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:855b5a8d1f4e3daa96b2daef23189f2f40c2d2bb182967057c59ebd8c132f150
      lastState: {}
      name: webhook
      ready: true
      restartCount: 1
      started: true
      state:
        running:
          startedAt: "2025-10-27T12:37:16Z"
      volumeMounts:
      - mountPath: /etc/webhook-cert/
        name: webhook-cert
      - mountPath: /env
        name: env-overrides
      - mountPath: /var/run/ovnkube-identity-config
        name: ovnkube-identity-cm
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: kube-api-access-m6hcm
        readOnly: true
        recursiveReadOnly: Disabled
    hostIP: 10.46.248.134
    hostIPs:
    - ip: 10.46.248.134
    - ip: 2620:52:0:2ef8::86
    phase: Running
    podIP: 10.46.248.134
    podIPs:
    - ip: 10.46.248.134
    - ip: 2620:52:0:2ef8::86
    qosClass: Burstable
    startTime: "2025-10-27T11:30:08Z"
kind: PodList
metadata:
  resourceVersion: "2220415"
