I ran oauth-apiserver locally with telepresence and delve, and then executed the proposed apply tests [1] against the cluster. I observed that the reported error was due to the fieldManager's typeConverter having an unpopulated gvks map [2]. This map is supposed to be set on api resource registration from the `x-kubernetes-group-version-kind` field of each openapi model.

I retrieved the openapi spec from a 4.7 cluster:

$ oc get --raw /openapi/v2

I retrieved the openapi spec from the cluster's oauth-apiserver:

$ oc port-forward -n openshift-oauth-apiserver $(oc get pods -n openshift-oauth-apiserver --no-headers | head -1 | cut -d' ' -f1) 8443:8443
$ curl -H "Authorization: Bearer $(oc whoami -t)" -Lk "https://localhost:8443/openapi/v2"

Comparing the results revealed that the oauth-apiserver openapi spec was missing `x-kubernetes-group-version-kind` from its definitions:

cluster openapi:

"com.github.openshift.api.oauth.v1.OAuthClient": {
 <snip>
  "x-kubernetes-group-version-kind": [
    {
      "group": "",
      "kind": "OAuthClient",
      "version": "v1"
    },
    {
      "group": "oauth.openshift.io",
      "kind": "OAuthClient",
      "version": "v1"
    }
  ]
}

oauth openapi:

"com.github.openshift.api.oauth.v1.OAuthClient": {
  <snip>
}


1: https://github.com/openshift/origin/pull/25652
2: https://github.com/openshift/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/typeconverter.go#L87

----------------------------

Debugging instructions:

- disabled CVO management of the auth operator as per [3]

- scaled down the auth operator deployment

$ oc scale deploy authentication-operator -n openshift-authentication-operator --replicas=0

- retrieved the set of arguments currently used to run the oauth apiserver

$ oc get deploy apiserver -n openshift-oauth-apiserver -o yaml

- computed the telepresence arguments necessary to proxy all nodes in a target cluster

$ ALSO_PROXY="$(oc get machines -A -o json | jq -jr '.items[] | .status.addresses[0].address | @text "--also-proxy=\(.) "')"

- ran telepresence to get a shell with the environment of the oauth-apiserver

$ telepresence --namespace=openshift-oauth-apiserver --swap-deployment=apiserver --mount=/tmp/tel_root ${ALSO_PROXY} --run bash

- symlinked `/tmp/tel_root/{configmaps,secrets}` to /var/run/

- ran oauth-apiserver with `dlv debug` and the current set of arguments (previously sourced from the deployment) in the telepresence shell

3:  https://github.com/openshift/enhancements/blob/master/enhancements/operator-dev-doc.md#option-a---start-with-a-running-cluster

It should be possible verify this bug manually, but I'm also adding e2e testing that I'll ensure is backported to 4.6.

Verified in 4.7.0-0.nightly-2020-11-06-010750, oauth-apiserver logs don't have SHOULD NOT HAPPEN now.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633