From 14f83de915faccce9b9cc4dff0032346aa659a18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=83=93=E3=82=AF=E3=82=BF=E3=80=80=E3=83=8F=E3=83=B3?= =?UTF-8?q?=E3=82=B0?= Date: Fri, 24 Jul 2026 07:54:15 +0200 Subject: [PATCH] fix: when --authorization-config is present, do not apply the --authorization-mode, fix #1120 (#1237) Signed-off-by: Victor Hang --- internal/builders/controlplane/deployment.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/builders/controlplane/deployment.go b/internal/builders/controlplane/deployment.go index e198384..50e9956 100644 --- a/internal/builders/controlplane/deployment.go +++ b/internal/builders/controlplane/deployment.go @@ -685,7 +685,6 @@ func (d Deployment) buildKubeAPIServerCommand(tenantControlPlane kamajiv1alpha1. // Opinionated defaults: applied only when the user didn't provide the same flag in ExtraArgs. safeDefaults := map[string]string{ "--allow-privileged": "true", - "--authorization-mode": "Node,RBAC", "--enable-bootstrap-token-auth": "true", "--requestheader-extra-headers-prefix": "X-Remote-Extra-", "--requestheader-group-headers": "X-Remote-Group", @@ -693,6 +692,12 @@ func (d Deployment) buildKubeAPIServerCommand(tenantControlPlane kamajiv1alpha1. "--service-account-issuer": "https://kubernetes.default.svc.cluster.local", } + // https://github.com/kubernetes/kubernetes/blob/6720f0f96000abb82ad51d1177489b04188819d8/cmd/kubeadm/app/phases/controlplane/manifests.go#L253-L255 + // Mirror kubeadm's mutually exclusive configuration + if _, ok := utilities.ArgsFromSliceToMap(userExtras)["--authorization-config"]; !ok { + safeDefaults["--authorization-mode"] = "Node,RBAC" + } + // backward compatibility for deprecated CIDR fields serviceCIDRs := utilities.GetEffectiveCIDRs(tenantControlPlane.Spec.NetworkProfile.ServiceCIDR, tenantControlPlane.Spec.NetworkProfile.ServiceCIDRs)