---
apiVersion: apps/v1
items:
- apiVersion: apps/v1
  kind: ReplicaSet
  metadata:
    annotations:
      deployment.kubernetes.io/desired-replicas: "3"
      deployment.kubernetes.io/max-replicas: "3"
      deployment.kubernetes.io/revision: "1"
      operator.openshift.io/dep-openshift-oauth-apiserver.etcd-client.secret: 94KatA==
      operator.openshift.io/dep-openshift-oauth-apiserver.etcd-serving-ca.configmap: EpKTug==
      operator.openshift.io/spec-hash: 560f665604eb9915a1215a1aeb96dda27ecb196c82e322b2d90b9491079d3fe7
    creationTimestamp: "2022-03-08T10:41:17Z"
    generation: 1
    labels:
      apiserver: "true"
      app: openshift-oauth-apiserver
      oauth-apiserver-anti-affinity: "true"
      pod-template-hash: b7585d69b
      revision: "2"
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deployment.kubernetes.io/desired-replicas: {}
            f:deployment.kubernetes.io/max-replicas: {}
            f:deployment.kubernetes.io/revision: {}
            f:operator.openshift.io/dep-openshift-oauth-apiserver.etcd-client.secret: {}
            f:operator.openshift.io/dep-openshift-oauth-apiserver.etcd-serving-ca.configmap: {}
            f:operator.openshift.io/spec-hash: {}
          f:labels:
            .: {}
            f:apiserver: {}
            f:app: {}
            f:oauth-apiserver-anti-affinity: {}
            f:pod-template-hash: {}
            f:revision: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"77b86905-6e0e-48bd-b5a3-54862ff39d7f"}:
              .: {}
              f:apiVersion: {}
              f:blockOwnerDeletion: {}
              f:controller: {}
              f:kind: {}
              f:name: {}
              f:uid: {}
        f:spec:
          f:replicas: {}
          f:selector:
            f:matchLabels:
              .: {}
              f:apiserver: {}
              f:app: {}
              f:pod-template-hash: {}
          f:template:
            f:metadata:
              f:annotations:
                .: {}
                f:operator.openshift.io/dep-openshift-oauth-apiserver.etcd-client.secret: {}
                f:operator.openshift.io/dep-openshift-oauth-apiserver.etcd-serving-ca.configmap: {}
              f:labels:
                .: {}
                f:apiserver: {}
                f:app: {}
                f:oauth-apiserver-anti-affinity: {}
                f:pod-template-hash: {}
                f:revision: {}
              f:name: {}
            f:spec:
              f:affinity:
                .: {}
                f:podAntiAffinity:
                  .: {}
                  f:requiredDuringSchedulingIgnoredDuringExecution: {}
              f:containers:
                k:{"name":"oauth-apiserver"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":8443,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/oauth-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/audit"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/etcd-serving-ca"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/configmaps/trusted-ca-bundle"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/encryption-config"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/etcd-client"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                    k:{"mountPath":"/var/run/secrets/serving-cert"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:dnsPolicy: {}
              f:initContainers:
                .: {}
                k:{"name":"fix-audit-permissions"}:
                  .: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/var/log/oauth-apiserver"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
              f:nodeSelector:
                .: {}
                f:node-role.kubernetes.io/master: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"audit-dir"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"audit-policies"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"encryption-config"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:optional: {}
                    f:secretName: {}
                k:{"name":"etcd-client"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"etcd-serving-ca"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"serving-cert"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
                k:{"name":"trusted-ca-bundle"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                    f:optional: {}
                  f:name: {}
        f:status:
          f:availableReplicas: {}
          f:fullyLabeledReplicas: {}
          f:observedGeneration: {}
          f:readyReplicas: {}
          f:replicas: {}
      manager: kube-controller-manager
      operation: Update
      time: "2022-03-08T10:41:29Z"
    name: apiserver-b7585d69b
    namespace: openshift-oauth-apiserver
    ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: Deployment
      name: apiserver
      uid: 77b86905-6e0e-48bd-b5a3-54862ff39d7f
    resourceVersion: "12711"
    selfLink: /apis/apps/v1/namespaces/openshift-oauth-apiserver/replicasets/apiserver-b7585d69b
    uid: cbce418e-0060-43f6-87f5-7f1289230ea1
  spec:
    replicas: 3
    selector:
      matchLabels:
        apiserver: "true"
        app: openshift-oauth-apiserver
        pod-template-hash: b7585d69b
    template:
      metadata:
        annotations:
          operator.openshift.io/dep-openshift-oauth-apiserver.etcd-client.secret: 94KatA==
          operator.openshift.io/dep-openshift-oauth-apiserver.etcd-serving-ca.configmap: EpKTug==
        creationTimestamp: null
        labels:
          apiserver: "true"
          app: openshift-oauth-apiserver
          oauth-apiserver-anti-affinity: "true"
          pod-template-hash: b7585d69b
          revision: "2"
        name: openshift-oauth-apiserver
      spec:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  apiserver: "true"
                  app: openshift-oauth-apiserver
                  oauth-apiserver-anti-affinity: "true"
              topologyKey: kubernetes.io/hostname
        containers:
        - args:
          - |
            if [ -s /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem ]; then
              echo "Copying system trust bundle"
              cp -f /var/run/configmaps/trusted-ca-bundle/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            fi
            exec oauth-apiserver start \
              --secure-port=8443 \
              --audit-log-path=/var/log/oauth-apiserver/audit.log \
              --audit-log-format=json \
              --audit-log-maxsize=100 \
              --audit-log-maxbackup=10 \
              --etcd-cafile=/var/run/configmaps/etcd-serving-ca/ca-bundle.crt \
              --etcd-keyfile=/var/run/secrets/etcd-client/tls.key \
              --etcd-certfile=/var/run/secrets/etcd-client/tls.crt \
              --shutdown-delay-duration=3s \
              --tls-private-key-file=/var/run/secrets/serving-cert/tls.key \
              --tls-cert-file=/var/run/secrets/serving-cert/tls.crt \
              --audit-policy-file=/var/run/configmaps/audit/secure-oauth-storage-default.yaml \
            --cors-allowed-origins='//127\.0\.0\.1(:|$)' \
            --cors-allowed-origins='//localhost(:|$)' \
            --etcd-servers=https://10.0.94.119:2379 \
            --etcd-servers=https://10.0.94.219:2379 \
            --etcd-servers=https://10.0.95.76:2379 \
            --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 \
            --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 \
            --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 \
            --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 \
            --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 \
            --tls-cipher-suites=TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 \
            --tls-min-version=VersionTLS12 \
            --v=2
          command:
          - /bin/bash
          - -ec
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:19eac3f0c1f7b016f50511bbc48f807966a9690da7e461bfd7443fe7875de633
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: healthz
              port: 8443
              scheme: HTTPS
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: oauth-apiserver
          ports:
          - containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 10
            httpGet:
              path: readyz
              port: 8443
              scheme: HTTPS
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 150m
              memory: 200Mi
          securityContext:
            privileged: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/run/configmaps/audit
            name: audit-policies
          - mountPath: /var/run/secrets/etcd-client
            name: etcd-client
          - mountPath: /var/run/configmaps/etcd-serving-ca
            name: etcd-serving-ca
          - mountPath: /var/run/configmaps/trusted-ca-bundle
            name: trusted-ca-bundle
          - mountPath: /var/run/secrets/serving-cert
            name: serving-cert
          - mountPath: /var/run/secrets/encryption-config
            name: encryption-config
          - mountPath: /var/log/oauth-apiserver
            name: audit-dir
        dnsPolicy: ClusterFirst
        initContainers:
        - command:
          - sh
          - -c
          - chmod 0700 /var/log/oauth-apiserver
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:19eac3f0c1f7b016f50511bbc48f807966a9690da7e461bfd7443fe7875de633
          imagePullPolicy: IfNotPresent
          name: fix-audit-permissions
          resources: {}
          securityContext:
            privileged: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /var/log/oauth-apiserver
            name: audit-dir
        nodeSelector:
          node-role.kubernetes.io/master: ""
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: oauth-apiserver-sa
        serviceAccountName: oauth-apiserver-sa
        terminationGracePeriodSeconds: 70
        tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 120
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 120
        volumes:
        - configMap:
            defaultMode: 420
            name: audit-2
          name: audit-policies
        - name: etcd-client
          secret:
            defaultMode: 420
            secretName: etcd-client
        - configMap:
            defaultMode: 420
            name: etcd-serving-ca
          name: etcd-serving-ca
        - name: serving-cert
          secret:
            defaultMode: 420
            secretName: serving-cert
        - configMap:
            defaultMode: 420
            items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem
            name: trusted-ca-bundle
            optional: true
          name: trusted-ca-bundle
        - name: encryption-config
          secret:
            defaultMode: 420
            optional: true
            secretName: encryption-config-2
        - hostPath:
            path: /var/log/oauth-apiserver
            type: ""
          name: audit-dir
  status:
    availableReplicas: 3
    fullyLabeledReplicas: 3
    observedGeneration: 1
    readyReplicas: 3
    replicas: 3
kind: ReplicaSetList
metadata:
  resourceVersion: "82508"
  selfLink: /apis/apps/v1/namespaces/openshift-oauth-apiserver/replicasets
