Code change:
"--etcd-keyfile=" + filepath.Join(testCertsDir, "apiserver-etcd-client.key"), }, }, <ins> { name: "authorization-config extra-args", cfg: &kubeadmapi.ClusterConfiguration{ Networking:      kubeadmapi.Networking{ServiceSubnet: "bar", DNSDomain: "cluster.local"}, CertificatesDir: testCertsDir, APIServer: kubeadmapi.APIServer{ ControlPlaneComponent: kubeadmapi.ControlPlaneComponent{ ExtraArgs: []kubeadmapi.Arg{ {Name: "authorization-config", Value: "/path/to/authorization/config/file"}, }, }, }, }, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"}, expected: []string{ "kube-apiserver", "--enable-admission-plugins=NodeRestriction", "--service-cluster-ip-range=bar", "--service-account-key-file=" + filepath.Join(testCertsDir, "sa.pub"), "--service-account-signing-key-file=" + filepath.Join(testCertsDir, "sa.key"), "--service-account-issuer=https://kubernetes.default.svc.cluster.local", "--client-ca-file=" + filepath.Join(testCertsDir, "ca.crt"), "--tls-cert-file=" + filepath.Join(testCertsDir, "apiserver.crt"), "--tls-private-key-file=" + filepath.Join(testCertsDir, "apiserver.key"), "--kubelet-client-certificate=" + filepath.Join(testCertsDir, "apiserver-kubelet-client.crt"), "--kubelet-client-key=" + filepath.Join(testCertsDir, "apiserver-kubelet-client.key"), "--enable-bootstrap-token-auth=true", "--secure-port=123", "--allow-privileged=true", "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname", "--proxy-client-cert-file=" + filepath.FromSlash("/var/lib/certs/front-proxy-client.crt"), "--proxy-client-key-file=" + filepath.FromSlash("/var/lib/certs/front-proxy-client.key"), "--requestheader-username-headers=X-Remote-User", "--requestheader-group-headers=X-Remote-Group", "--requestheader-extra-headers-prefix=X-Remote-Extra-", "--requestheader-client-ca-file=" + filepath.Join(testCertsDir, "front-proxy-ca.crt"), "--requestheader-allowed-names=front-proxy-client", "--authorization-config=/path/to/authorization/config/file", "--advertise-address=1.2.3.4", fmt.Sprintf("--etcd-servers=https://127.0.0.1:%d", kubeadmconstants.EtcdListenClientPort), "--etcd-cafile=" + filepath.Join(testCertsDir, "etcd/ca.crt"), "--etcd-certfile=" + filepath.Join(testCertsDir, "apiserver-etcd-client.crt"), "--etcd-keyfile=" + filepath.Join(testCertsDir, "apiserver-etcd-client.key"), }, }, { // Note that we do not block it at this level but api server would fail to start. name: "authorization-config and authorization-mode extra-args", cfg: &kubeadmapi.ClusterConfiguration{ Networking:      kubeadmapi.Networking{ServiceSubnet: "bar", DNSDomain: "cluster.local"}, CertificatesDir: testCertsDir, APIServer: kubeadmapi.APIServer{ ControlPlaneComponent: kubeadmapi.ControlPlaneComponent{ ExtraArgs: []kubeadmapi.Arg{ {Name: "authorization-config", Value: "/path/to/authorization/config/file"}, {Name: "authorization-mode", Value: strings.Join([]string{ kubeadmconstants.ModeNode, kubeadmconstants.ModeRBAC, kubeadmconstants.ModeWebhook, }, ",")}, }, }, }, }, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"}, expected: []string{ "kube-apiserver", "--enable-admission-plugins=NodeRestriction", "--service-cluster-ip-range=bar", "--service-account-key-file=" + filepath.Join(testCertsDir, "sa.pub"), "--service-account-signing-key-file=" + filepath.Join(testCertsDir, "sa.key"), "--service-account-issuer=https://kubernetes.default.svc.cluster.local", "--client-ca-file=" + filepath.Join(testCertsDir, "ca.crt"), "--tls-cert-file=" + filepath.Join(testCertsDir, "apiserver.crt"), "--tls-private-key-file=" + filepath.Join(testCertsDir, "apiserver.key"), "--kubelet-client-certificate=" + filepath.Join(testCertsDir, "apiserver-kubelet-client.crt"), "--kubelet-client-key=" + filepath.Join(testCertsDir, "apiserver-kubelet-client.key"), "--enable-bootstrap-token-auth=true", "--secure-port=123", "--allow-privileged=true", "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname", "--proxy-client-cert-file=" + filepath.FromSlash("/var/lib/certs/front-proxy-client.crt"), "--proxy-client-key-file=" + filepath.FromSlash("/var/lib/certs/front-proxy-client.key"), "--requestheader-username-headers=X-Remote-User", "--requestheader-group-headers=X-Remote-Group", "--requestheader-extra-headers-prefix=X-Remote-Extra-", "--requestheader-client-ca-file=" + filepath.Join(testCertsDir, "front-proxy-ca.crt"), "--requestheader-allowed-names=front-proxy-client", "--authorization-config=/path/to/authorization/config/file", "--authorization-mode=Node,RBAC,Webhook", "--advertise-address=1.2.3.4", fmt.Sprintf("--etcd-servers=https://127.0.0.1:%d", kubeadmconstants.EtcdListenClientPort), "--etcd-cafile=" + filepath.Join(testCertsDir, "etcd/ca.crt"), "--etcd-certfile=" + filepath.Join(testCertsDir, "apiserver-etcd-client.crt"), "--etcd-keyfile=" + filepath.Join(testCertsDir, "apiserver-etcd-client.key"), }, }, </ins> } for _, rt := range tests {

Related discussion:
text: TL;DR prevents us from using structured authz (setting flag) as those flags are mutually exclusive /cc (as the author of ) /cc FYI To use structured authz you need to define the authorization configuration using the flag. However this flag is mutually exclusive with and flags. (refer to & ) Kubeadam adds by default ( & ) which prevents us from using I should be able to define the flag and have structured authz working. Spin up a kind cluster using this kind config (make sure the images are 1.29 for structured authz to be avaliable) (For this bug, the content of doesn't matter.) However, the cluster become unhealthy. docker exec to the kind cluster container, where we can see the inner container of the apiserver has exited. Running we can see this error <img width="1720" alt="image" src=""No response_ <details</details<detailsN/A -I am using kind </details<details</details<details</details<details</details<details</details
There are no sig labels on this issue. Please add an appropriate label by using one of the following commands: - Please see the for a listing of the SIGs, working groups, and committees available. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
FYI, in case someone opens similar issue in Kind. I might be wrong but I think this effectively means that kind users cant use structured authz (unless it supports a mode to spin up a cluster without kubeadam).