Description of problem: For hosted deployments, the Kubernetes API server that the OpenShift API server communicates with is not the in-cluster server, but rather an explicit kubeconfig must be specified. Recent changes in the OpenShift APIserver code only allow for the in-cluster connection to the Kube API server. CLI flags need to be exposed to allow specifying a different kubeconfig to communicate with an external Kube API server. Version-Release number of selected component (if applicable): 4.3 How reproducible: Always Steps to Reproduce: 1. Start OpenShift APIServer in hosted mode (on management Kube APIserver) Actual results: OpenShift APIServer fails to start because it cannot communicate with a Kube APIServer Expected results: OpenShift APIServer starts and communicates with peer Kube APIServer. Additional info: To verify this, simply run the openshift-apiserver command with --help. There should be flags to allow specifying the authentication and authorization kube apiserver.
Per above hint and https://github.com/openshift/openshift-apiserver/pull/54/files#diff-3f6215a8bff8638652a2886ff35d2b5bR88 `o.Authentication.AddFlags(flags)`, and openshift/openshift-apiserver/vendor/k8s.io/apiserver/pkg/server/options/{authentication,authorization}.go def of `AddFlags`, confirmed the verification in 4.3.0-0.nightly-2019-12-10-235659 by: oc rsh -n openshift-apiserver ds/apiserver sh-4.2# openshift-apiserver start --help Start an apiserver that contains the OpenShift resources ... Flags: --authentication-kubeconfig string kubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenaccessreviews.authentication.k8s.io. ... --authorization-kubeconfig string kubeconfig file pointing at the 'core' kubernetes server with enough rights to create subjectaccessreviews.authorization.k8s.io.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0062