allow openshift-apiserver to avoid SAR for certain paths and groups
@@ -129,7 +129,7 @@ func NewOpenshiftAPIConfig(config *openshiftcontrolplanev1.OpenShiftAPIServerCon
if err := authenticationOptions.ApplyTo(&genericConfig.Authentication, genericConfig.SecureServing, genericConfig.OpenAPIConfig); err != nil {
return nil, err
}
- authorizationOptions := genericapiserveroptions.NewDelegatingAuthorizationOptions()
+ authorizationOptions := genericapiserveroptions.NewDelegatingAuthorizationOptions().WithAlwaysAllowPaths("/healthz", "/healthz/").WithAlwaysAllowGroups("system:masters")
authorizationOptions.RemoteKubeConfigFile = config.KubeClientConfig.KubeConfig
if err := authorizationOptions.ApplyTo(&genericConfig.Authorization); err != nil {
return nil, err
