don't fight with CRDs for SCC and RBR
package openshift_kube_apiserver
import (
- "k8s.io/klog"
-
+ "k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apiserver/pkg/admission"
genericapiserver "k8s.io/apiserver/pkg/server"
+ "k8s.io/klog"
"k8s.io/kube-aggregator/pkg/apiserver"
"k8s.io/kubernetes/cmd/kube-apiserver/app"
"k8s.io/kubernetes/pkg/capabilities"
+ "k8s.io/kubernetes/pkg/kubeapiserver/options"
kubelettypes "k8s.io/kubernetes/pkg/kubelet/types"
"k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy"
kubecontrolplanev1 "github.com/openshift/api/kubecontrolplane/v1"
-
"github.com/openshift/origin/pkg/admission/customresourcevalidation/customresourcevalidationregistration"
"github.com/openshift/origin/pkg/cmd/openshift-kube-apiserver/kubeadmission"
"github.com/openshift/origin/pkg/cmd/openshift-kube-apiserver/openshiftkubeapiserver"
- "k8s.io/kubernetes/pkg/kubeapiserver/options"
-
// for metrics
_ "k8s.io/kubernetes/pkg/client/metrics/prometheus"
)
@@ -27,6 +25,10 @@ func RunOpenShiftKubeAPIServerServer(kubeAPIServerConfig *kubecontrolplanev1.Kub
// This allows to move cluster resource quota to CRD
apiserver.AddAlwaysLocalDelegateForPrefix("/apis/quota.openshift.io/v1/clusterresourcequotas")
+ // This allows the CRD registration to avoid fighting with the APIService from the operator
+ apiserver.AddOverlappingGroupVersion(schema.GroupVersion{Group: "authorization.openshift.io", Version: "v1"})
+ apiserver.AddOverlappingGroupVersion(schema.GroupVersion{Group: "security.openshift.io", Version: "v1"})
+
// Allow privileged containers
capabilities.Initialize(capabilities.Capabilities{
AllowPrivileged: true,
