Stop serving admissionregistration.k8s.io/v1beta1.

Author: benluddy

control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go

@@ -214,7 +214,7 @@ func generateConfig(p KubeAPIServerConfigParams) (*kcpv1.KubeAPIServerConfig, er
 	args.Set("event-ttl", "3h")
 	// TODO remove in 4.16 once we're able to have different featuregates for hypershift
 	featureGates := append([]string{}, p.FeatureGates...)
-	featureGates = enforceFeatureGates(featureGates, "ValidatingAdmissionPolicy=true", "StructuredAuthenticationConfiguration=true")
+	featureGates = enforceFeatureGates(featureGates, "StructuredAuthenticationConfiguration=true")
 	args.Set("feature-gates", featureGates...)
 	args.Set("goaway-chance", p.GoAwayChance)
 	args.Set("http2-max-streams-per-connection", "2000")
@@ -236,9 +236,6 @@ func generateConfig(p KubeAPIServerConfigParams) (*kcpv1.KubeAPIServerConfig, er
 	args.Set("requestheader-username-headers", "X-Remote-User")
 	runtimeConfig := []string{}
 	for _, gate := range featureGates {
-		if gate == "ValidatingAdmissionPolicy=true" {
-			runtimeConfig = append(runtimeConfig, "admissionregistration.k8s.io/v1beta1=true")
-		}
 		if gate == "DynamicResourceAllocation=true" {
 			runtimeConfig = append(runtimeConfig, "resource.k8s.io/v1beta1=true")
 		}

control-plane-operator/controllers/hostedcontrolplane/v2/kas/config_test.go

@@ -515,26 +515,6 @@ func TestGenerateConfig(t *testing.T) {
 				},
 			),
 		},
-		{
-			name: "with ValidatingAdmissionPolicy feature gate explicitly enabled",
-			params: KubeAPIServerConfigParams{
-				FeatureGates: []string{
-					"ValidatingAdmissionPolicy=true",
-				},
-			},
-			// shouldn't be any different than the default configuration because this feature gate is enabled by default
-			expected: defaultKASConfig(),
-		},
-		{
-			name: "with ValidatingAdmissionPolicy feature gate explicitly disabled",
-			params: KubeAPIServerConfigParams{
-				FeatureGates: []string{
-					"ValidatingAdmissionPolicy=false",
-				},
-			},
-			// shouldn't be any different than the default configuration because this feature gate is forced to be enabled
-			expected: defaultKASConfig(),
-		},
 		{
 			name: "with StructuredAuthenticationConfiguration feature gate explicitly disabled",
 			params: KubeAPIServerConfigParams{
@@ -759,7 +739,6 @@ func defaultKASConfig() *kcpv1.KubeAPIServerConfig {
 			"event-ttl":                 {"3h"},
 			"feature-gates": {
 				"StructuredAuthenticationConfiguration=true",
-				"ValidatingAdmissionPolicy=true",
 			},
 			"goaway-chance":                    {""},
 			"http2-max-streams-per-connection": {"2000"},
@@ -783,7 +762,7 @@ func defaultKASConfig() *kcpv1.KubeAPIServerConfig {
 			"requestheader-extra-headers-prefix":      {"X-Remote-Extra-"},
 			"requestheader-group-headers":             {"X-Remote-Group"},
 			"requestheader-username-headers":          {"X-Remote-User"},
-			"runtime-config":                          {"admissionregistration.k8s.io/v1beta1=true"},
+			"runtime-config":                          {},
 			"service-account-issuer":                  {""},
 			"service-account-jwks-uri":                {"/openid/v1/jwks"},
 			"service-account-lookup":                  {"true"},