kind: Pod
apiVersion: v1
metadata:
  generateName: istio-ingressgateway-646db86885-
  annotations:
    openshift.io/scc: restricted-v2
    prometheus.io/port: '15020'
    k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.128.2.45/23"],"mac_address":"0a:58:0a:80:02:2d","gateway_ips":["10.128.2.1"],"routes":[{"dest":"10.128.0.0/14","nextHop":"10.128.2.1"},{"dest":"172.30.0.0/16","nextHop":"10.128.2.1"},{"dest":"169.254.0.5/32","nextHop":"10.128.2.1"},{"dest":"100.64.0.0/16","nextHop":"10.128.2.1"}],"ip_address":"10.128.2.45/23","gateway_ip":"10.128.2.1","role":"primary"}}'
    prometheus.io/path: /stats/prometheus
    inject.istio.io/templates: gateway
    sidecar.istio.io/status: '{"initContainers":null,"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
    k8s.v1.cni.cncf.io/network-status: |-
      [{
          "name": "ovn-kubernetes",
          "interface": "eth0",
          "ips": [
              "10.128.2.45"
          ],
          "mac": "0a:58:0a:80:02:2d",
          "default": true,
          "dns": {}
      }]
    istio.io/rev: default
    security.openshift.io/validated-scc-subject-type: user
    prometheus.io/scrape: 'true'
    proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","resources":{},"volumeMounts":[{"name":"kube-api-access-t84dg","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"Always","securityContext":{"capabilities":{"drop":["ALL"]},"runAsUser":1000800000,"runAsNonRoot":true,"allowPrivilegeEscalation":false}}]}'
  resourceVersion: '65705'
  name: istio-ingressgateway-646db86885-r52cf
  uid: 67d679f9-fb3a-46ea-8900-86cf583dc432
  creationTimestamp: '2025-11-06T07:30:01Z'
  generation: 1
  namespace: istio-ingress
  ownerReferences:
    - apiVersion: apps/v1
      kind: ReplicaSet
      name: istio-ingressgateway-646db86885
      uid: 0b1f1346-3ae5-4326-a8c3-78f5f8b992ab
      controller: true
      blockOwnerDeletion: true
  labels:
    app: istio-ingressgateway
    istio: ingressgateway
    pod-template-hash: 646db86885
    service.istio.io/canonical-name: istio-ingressgateway
    service.istio.io/canonical-revision: latest
    sidecar.istio.io/inject: 'true'
spec:
  restartPolicy: Always
  serviceAccountName: default
  imagePullSecrets:
    - name: default-dockercfg-nm5p9
  priority: 0
  schedulerName: default-scheduler
  enableServiceLinks: true
  terminationGracePeriodSeconds: 30
  preemptionPolicy: PreemptLowerPriority
  nodeName: mkralik1-jnkjm-worker-0-qfslf
  securityContext:
    seLinuxOptions:
      level: 's0:c28,c22'
    fsGroup: 1000800000
    sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: '0'
    seccompProfile:
      type: RuntimeDefault
  containers:
    - resources: {}
      readinessProbe:
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        timeoutSeconds: 3
        periodSeconds: 15
        successThreshold: 1
        failureThreshold: 4
      terminationMessagePath: /dev/termination-log
      name: istio-proxy
      env:
        - name: PILOT_CERT_PROVIDER
          value: istiod
        - name: CA_ADDR
          value: 'istiod.istio-system.svc:15012'
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: SERVICE_ACCOUNT
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.serviceAccountName
        - name: HOST_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
        - name: ISTIO_CPU_LIMIT
          valueFrom:
            resourceFieldRef:
              resource: limits.cpu
              divisor: '0'
        - name: PROXY_CONFIG
          value: |
            {}
        - name: ISTIO_META_POD_PORTS
          value: |-
            [
            ]
        - name: GOMEMLIMIT
          valueFrom:
            resourceFieldRef:
              resource: limits.memory
              divisor: '0'
        - name: GOMAXPROCS
          valueFrom:
            resourceFieldRef:
              resource: limits.cpu
              divisor: '0'
        - name: COMPLIANCE_POLICY
          value: fips-140-2
        - name: ISTIO_META_APP_CONTAINERS
        - name: ISTIO_META_CLUSTER_ID
          value: Kubernetes
        - name: ISTIO_META_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: ISTIO_META_INTERCEPTION_MODE
          value: REDIRECT
        - name: ISTIO_META_WORKLOAD_NAME
          value: istio-ingressgateway
        - name: ISTIO_META_OWNER
          value: 'kubernetes://apis/apps/v1/namespaces/istio-ingress/deployments/istio-ingressgateway'
        - name: ISTIO_META_MESH_ID
          value: cluster.local
        - name: TRUST_DOMAIN
          value: cluster.local
      securityContext:
        capabilities:
          drop:
            - ALL
        runAsUser: 1000800000
        runAsGroup: 1000809999
        runAsNonRoot: true
        allowPrivilegeEscalation: false
      ports:
        - name: http-envoy-prom
          containerPort: 15090
          protocol: TCP
      imagePullPolicy: Always
      volumeMounts:
        - name: workload-socket
          mountPath: /var/run/secrets/workload-spiffe-uds
        - name: credential-socket
          mountPath: /var/run/secrets/credential-uds
        - name: workload-certs
          mountPath: /var/run/secrets/workload-spiffe-credentials
        - name: istiod-ca-cert
          mountPath: /var/run/secrets/istio
        - name: istio-data
          mountPath: /var/lib/istio/data
        - name: istio-envoy
          mountPath: /etc/istio/proxy
        - name: istio-token
          mountPath: /var/run/secrets/tokens
        - name: istio-podinfo
          mountPath: /etc/istio/pod
        - name: kube-api-access-t84dg
          readOnly: true
          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      terminationMessagePolicy: File
      image: 'registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:dd1ced843e1976b4a24e9a924b3b72bec2675c38f93fe92911117a26c7b22f4b'
      args:
        - proxy
        - router
        - '--domain'
        - $(POD_NAMESPACE).svc.cluster.local
        - '--proxyLogLevel=warning'
        - '--proxyComponentLogLevel=misc:error'
        - '--log_output_level=default:info'
  serviceAccount: default
  volumes:
    - name: workload-socket
      emptyDir: {}
    - name: credential-socket
      emptyDir: {}
    - name: workload-certs
      emptyDir: {}
    - name: istio-envoy
      emptyDir:
        medium: Memory
    - name: istio-data
      emptyDir: {}
    - name: istio-podinfo
      downwardAPI:
        items:
          - path: labels
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.labels
          - path: annotations
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.annotations
        defaultMode: 420
    - name: istio-token
      projected:
        sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
        defaultMode: 420
    - name: istiod-ca-cert
      configMap:
        name: istio-ca-root-cert
        defaultMode: 420
    - name: kube-api-access-t84dg
      projected:
        sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              name: kube-root-ca.crt
              items:
                - key: ca.crt
                  path: ca.crt
          - downwardAPI:
              items:
                - path: namespace
                  fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
          - configMap:
              name: openshift-service-ca.crt
              items:
                - key: service-ca.crt
                  path: service-ca.crt
        defaultMode: 420
  dnsPolicy: ClusterFirst
  tolerations:
    - key: node.kubernetes.io/not-ready
      operator: Exists
      effect: NoExecute
      tolerationSeconds: 300
    - key: node.kubernetes.io/unreachable
      operator: Exists
      effect: NoExecute
      tolerationSeconds: 300

