update resourceconfig to have per-resource preferences take priority

cmd/kube-apiserver/app/aggregator.go

@@ -146,7 +146,7 @@ func createAggregatorServer(aggregatorConfig *aggregatorapiserver.Config, delega
 			// let the CRD controller process the initial set of CRDs before starting the autoregistration controller.
 			// this prevents the autoregistration controller's initial sync from deleting APIServices for CRDs that still exist.
 			// we only need to do this if CRDs are enabled on this server.  We can't use discovery because we are the source for discovery.
-			if aggregatorConfig.GenericConfig.MergedResourceConfig.AnyVersionForGroupEnabled("apiextensions.k8s.io") {
+			if aggregatorConfig.GenericConfig.MergedResourceConfig.AnyResourceForGroupEnabled("apiextensions.k8s.io") {
 				crdRegistrationController.WaitForInitialSync()
 			}
 			autoRegistrationController.Run(5, context.StopCh)

pkg/controlplane/instance.go

@@ -563,7 +563,7 @@ func (m *Instance) InstallAPIs(apiResourceConfigSource serverstorage.APIResource
 
 	for _, restStorageBuilder := range restStorageProviders {
 		groupName := restStorageBuilder.GroupName()
-		if !apiResourceConfigSource.AnyVersionForGroupEnabled(groupName) {
+		if !apiResourceConfigSource.AnyResourceForGroupEnabled(groupName) {
 			klog.V(1).Infof("Skipping disabled API group %q.", groupName)
 			continue
 		}

staging/src/k8s.io/apiserver/pkg/server/resourceconfig/helpers.go

@@ -87,8 +87,6 @@ var (
 		// allows users to address all alpha api versions
 		APIAlpha: func(gvr schema.GroupVersionResource) bool { return alphaPattern.MatchString(gvr.Version) },
 	}
-
-	groupVersionResourceMatchersOrder = []string{APIAll, APIGA, APIBeta, APIAlpha}
 )
 
 func resourceMatcherForVersion(gv schema.GroupVersion) func(gvr schema.GroupVersionResource) bool {
@@ -192,11 +190,11 @@ func MergeAPIResourceConfigs(
 		// if a user has expressed a preference about a version, that preference takes priority over the hardcoded resources
 		resourceConfig.RemoveMatchingResourcePreferences(resourceMatcherForVersion(versionPreference.groupVersion))
 		if versionPreference.enabled {
-			// enable the groupVersion for "group/version=true" and "group/version/resource=true"
+			// enable the groupVersion for "group/version=true"
 			resourceConfig.EnableVersions(versionPreference.groupVersion)
 
 		} else {
-			// disable the groupVersion only for "group/version=false", not "group/version/resource=false"
+			// disable the groupVersion only for "group/version=false"
 			resourceConfig.DisableVersions(versionPreference.groupVersion)
 		}
 	}
@@ -204,6 +202,7 @@ func MergeAPIResourceConfigs(
 	// apply resource preferences last, so they have the highest priority
 	for _, resourcePreference := range resourcePreferences {
 		if resourcePreference.enabled {
+			// enable the resource for "group/version/resource=true"
 			resourceConfig.EnableResources(resourcePreference.groupVersionResource)
 		} else {
 			resourceConfig.DisableResources(resourcePreference.groupVersionResource)

staging/src/k8s.io/apiserver/pkg/server/resourceconfig/helpers_test.go

@@ -20,15 +20,13 @@ import (
 	"reflect"
 	"testing"
 
-	appsv1 "k8s.io/api/apps/v1"
-
-	"k8s.io/apimachinery/pkg/runtime/schema"
-
 	"github.com/stretchr/testify/require"
 
+	appsv1 "k8s.io/api/apps/v1"
 	apiv1 "k8s.io/api/core/v1"
 	extensionsapiv1beta1 "k8s.io/api/extensions/v1beta1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	serverstore "k8s.io/apiserver/pkg/server/storage"
 )
 
@@ -40,6 +38,7 @@ func TestParseRuntimeConfig(t *testing.T) {
 		runtimeConfig         map[string]string
 		defaultResourceConfig func() *serverstore.ResourceConfig
 		expectedAPIConfig     func() *serverstore.ResourceConfig
+		expectedEnabledAPIs   map[schema.GroupVersionResource]bool
 		err                   bool
 	}{
 		{
@@ -65,6 +64,7 @@ func TestParseRuntimeConfig(t *testing.T) {
 			expectedAPIConfig: func() *serverstore.ResourceConfig {
 				return newFakeAPIResourceConfigSource()
 			},
+			expectedEnabledAPIs: defaultFakeEnabledResources(),
 			err:                 false,
 		},
 		{
@@ -80,6 +80,7 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableVersions(extensionsapiv1beta1.SchemeGroupVersion)
 				return config
 			},
+			expectedEnabledAPIs: defaultFakeEnabledResources(),
 			err:                 false,
 		},
 		{
@@ -95,6 +96,7 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config := newFakeAPIResourceConfigSource()
 				return config
 			},
+			expectedEnabledAPIs: defaultFakeEnabledResources(),
 			err:                 false,
 		},
 		{
@@ -110,6 +112,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableVersions(apiv1GroupVersion)
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       false,
+			},
 			err: false,
 		},
 		{
@@ -123,6 +133,7 @@ func TestParseRuntimeConfig(t *testing.T) {
 			expectedAPIConfig: func() *serverstore.ResourceConfig {
 				return newFakeAPIResourceConfigSource()
 			},
+			expectedEnabledAPIs: defaultFakeEnabledResources(),
 			err:                 false,
 		},
 		{
@@ -140,6 +151,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.RemoveMatchingResourcePreferences(matchAllExplicitResourcesForFake)
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  true,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false,
 		},
 		{
@@ -159,6 +178,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.RemoveMatchingResourcePreferences(matchAllExplicitResourcesForFake)
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               false,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false,
 		},
 		{
@@ -174,7 +201,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.EnableResources(extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
-			err: false,
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			}, err: false,
 		},
 		{
 			name: "disable-specific-extensions-resources",
@@ -189,7 +223,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableResources(extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"))
 				return config
 			},
-			err: false,
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			}, err: false,
 		},
 		{
 			name: "disable-all-extensions-resources",
@@ -206,7 +247,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.RemoveMatchingResourcePreferences(matchAllExplicitResourcesForFake)
 				return config
 			},
-			err: false,
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			}, err: false,
 		},
 		{
 			name: "disable-a-no-extensions-resources",
@@ -221,6 +269,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               false,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -238,6 +294,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.RemoveMatchingResourcePreferences(matchAllExplicitResourcesForFake)
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -254,6 +318,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               false,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -271,6 +343,15 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.EnableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				appsv1.SchemeGroupVersion.WithResource("other"):                     false,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -287,6 +368,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               false,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -305,6 +394,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.EnableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       false,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -324,6 +421,15 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               false,
+				appsv1.SchemeGroupVersion.WithResource("other"):                     true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       false,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -343,6 +449,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.EnableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       false,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -361,6 +475,14 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.DisableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               false,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false, // no error for backwards compatibility
 		},
 		{
@@ -379,6 +501,15 @@ func TestParseRuntimeConfig(t *testing.T) {
 				config.EnableResources(appsv1.SchemeGroupVersion.WithResource("deployments"))
 				return config
 			},
+			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+				extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+				appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+				appsv1.SchemeGroupVersion.WithResource("other"):                     false,
+				apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+			},
 			err: false, // no error for backwards compatibility
 		},
 	}
@@ -399,6 +530,20 @@ func TestParseRuntimeConfig(t *testing.T) {
 			if !reflect.DeepEqual(actualDisablers, expectedConfig) {
 				t.Fatalf("%v: unexpected apiResourceDisablers. Actual: %v\n expected: %v", test.runtimeConfig, actualDisablers, expectedConfig)
 			}
+
+			for _, resourceToCheck := range apiResourcesToCheck() {
+				actual := actualDisablers.ResourceEnabled(resourceToCheck)
+				expected := test.expectedEnabledAPIs[resourceToCheck]
+				if actual != expected {
+					t.Errorf("for %v, actual=%v, expected=%v", resourceToCheck, actual, expected)
+				}
+			}
+			for resourceToCheck, expected := range test.expectedEnabledAPIs {
+				actual := actualDisablers.ResourceEnabled(resourceToCheck)
+				if actual != expected {
+					t.Errorf("for %v, actual=%v, expected=%v", resourceToCheck, actual, expected)
+				}
+			}
 		})
 	}
 }
@@ -432,7 +577,29 @@ func matchAllExplicitResourcesForFake(gvr schema.GroupVersionResource) bool {
 		return true
 	}
 	return false
+}
 
+// apiResourcesToCheck are the apis we use in this set of unit tests.  They will be check for enable/disable status
+func apiResourcesToCheck() []schema.GroupVersionResource {
+	return []schema.GroupVersionResource{
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"),
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"),
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"),
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"),
+		appsv1.SchemeGroupVersion.WithResource("deployments"),
+		apiv1.SchemeGroupVersion.WithResource("pods"),
+	}
+}
+
+func defaultFakeEnabledResources() map[schema.GroupVersionResource]bool {
+	return map[schema.GroupVersionResource]bool{
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   true,
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,
+		extensionsapiv1beta1.SchemeGroupVersion.WithResource("daemonsets"):  false,
+		appsv1.SchemeGroupVersion.WithResource("deployments"):               true,
+		apiv1.SchemeGroupVersion.WithResource("pods"):                       true,
+	}
 }
 
 func newFakeScheme(t *testing.T) *runtime.Scheme {

staging/src/k8s.io/apiserver/pkg/server/storage/resource_config.go

@@ -24,7 +24,7 @@ import (
 type APIResourceConfigSource interface {
 	VersionEnabled(version schema.GroupVersion) bool
 	ResourceEnabled(resource schema.GroupVersionResource) bool
-	AnyVersionForGroupEnabled(group string) bool
+	AnyResourceForGroupEnabled(group string) bool
 }
 
 var _ APIResourceConfigSource = &ResourceConfig{}
@@ -38,20 +38,6 @@ func NewResourceConfig() *ResourceConfig {
 	return &ResourceConfig{GroupVersionConfigs: map[schema.GroupVersion]bool{}, ResourceConfigs: map[schema.GroupVersionResource]bool{}}
 }
 
-// DisableAll disables all group/versions. It does not modify individual resource enablement/disablement.
-func (o *ResourceConfig) DisableAll() {
-	for k := range o.GroupVersionConfigs {
-		o.GroupVersionConfigs[k] = false
-	}
-}
-
-// EnableAll enables all group/versions. It does not modify individual resource enablement/disablement.
-func (o *ResourceConfig) EnableAll() {
-	for k := range o.GroupVersionConfigs {
-		o.GroupVersionConfigs[k] = true
-	}
-}
-
 // DisableMatchingVersions disables all group/versions for which the matcher function returns true. It does not modify individual resource enablement/disablement.
 func (o *ResourceConfig) DisableMatchingVersions(matcher func(gv schema.GroupVersion) bool) {
 	for k := range o.GroupVersionConfigs {
@@ -97,6 +83,7 @@ func (o *ResourceConfig) EnableVersions(versions ...schema.GroupVersion) {
 	}
 }
 
+// TODO this must be removed and we enable/disable individual resources.
 func (o *ResourceConfig) VersionEnabled(version schema.GroupVersion) bool {
 	enabled, _ := o.GroupVersionConfigs[version]
 	return enabled
@@ -115,17 +102,20 @@ func (o *ResourceConfig) EnableResources(resources ...schema.GroupVersionResourc
 }
 
 func (o *ResourceConfig) ResourceEnabled(resource schema.GroupVersionResource) bool {
-	if !o.VersionEnabled(resource.GroupVersion()) {
-		return false
-	}
+	// if a resource is explicitly set, that takes priority over the preference of the version.
 	resourceEnabled, explicitlySet := o.ResourceConfigs[resource]
-	if !explicitlySet {
-		return true
-	}
+	if explicitlySet {
 		return resourceEnabled
 	}
 
-func (o *ResourceConfig) AnyVersionForGroupEnabled(group string) bool {
+	if !o.VersionEnabled(resource.GroupVersion()) {
+		return false
+	}
+	// they are enabled by default.
+	return true
+}
+
+func (o *ResourceConfig) AnyResourceForGroupEnabled(group string) bool {
 	for version := range o.GroupVersionConfigs {
 		if version.Group == group {
 			if o.VersionEnabled(version) {
@@ -133,6 +123,11 @@ func (o *ResourceConfig) AnyVersionForGroupEnabled(group string) bool {
 			}
 		}
 	}
+	for resource := range o.ResourceConfigs {
+		if resource.Group == group && o.ResourceEnabled(resource) {
+			return true
+		}
+	}
 
 	return false
 }

staging/src/k8s.io/apiserver/pkg/server/storage/resource_config_test.go

@@ -65,16 +65,19 @@ func TestDisabledResource(t *testing.T) {
 	config.EnableResources(g1v1rEnabled, g1v2rEnabled, g2v1rEnabled)
 	config.DisableResources(g1v1rDisabled, g1v2rDisabled, g2v1rDisabled)
 
-	// all resources under g1v1 are disabled because the group-version is disabled
+	// all resources not explicitly enabled under g1v1 are disabled because the group-version is disabled
 	if config.ResourceEnabled(g1v1rUnspecified) {
 		t.Errorf("expected disabled for %v, from %v", g1v1rUnspecified, config)
 	}
-	if config.ResourceEnabled(g1v1rEnabled) {
-		t.Errorf("expected disabled for %v, from %v", g1v1rEnabled, config)
+	if !config.ResourceEnabled(g1v1rEnabled) {
+		t.Errorf("expected enabled for %v, from %v", g1v1rEnabled, config)
 	}
 	if config.ResourceEnabled(g1v1rDisabled) {
 		t.Errorf("expected disabled for %v, from %v", g1v1rDisabled, config)
 	}
+	if config.ResourceEnabled(g1v1rUnspecified) {
+		t.Errorf("expected disabled for %v, from %v", g1v1rUnspecified, config)
+	}
 
 	// explicitly disabled resources in enabled group-versions are disabled
 	if config.ResourceEnabled(g1v2rDisabled) {
@@ -97,61 +100,6 @@ func TestDisabledResource(t *testing.T) {
 	if !config.ResourceEnabled(g2v1rEnabled) {
 		t.Errorf("expected enabled for %v, from %v", g2v1rEnabled, config)
 	}
-
-	// DisableAll() only disables to the group/version level for compatibility
-	// corresponds to --runtime-config=api/all=false
-	config.DisableAll()
-	if config.ResourceEnabled(g1v1rEnabled) {
-		t.Errorf("expected disabled for %v, from %v", g1v1rEnabled, config)
-	}
-	if config.ResourceEnabled(g1v2rEnabled) {
-		t.Errorf("expected disabled for %v, from %v", g1v2rEnabled, config)
-	}
-	if config.ResourceEnabled(g2v1rEnabled) {
-		t.Errorf("expected disabled for %v, from %v", g2v1rEnabled, config)
-	}
-
-	// DisableAll() only disables to the group/version level for compatibility
-	// corresponds to --runtime-config=api/all=false,g1/v1=true
-	config.DisableAll()
-	config.EnableVersions(g1v1)
-	if !config.ResourceEnabled(g1v1rEnabled) {
-		t.Errorf("expected enabled for %v, from %v", g1v1rEnabled, config)
-	}
-
-	// EnableAll() only enables to the group/version level for compatibility
-	config.EnableAll()
-
-	// all unspecified or enabled resources under all groups now enabled
-	if !config.ResourceEnabled(g1v1rUnspecified) {
-		t.Errorf("expected enabled for %v, from %v", g1v1rUnspecified, config)
-	}
-	if !config.ResourceEnabled(g1v1rEnabled) {
-		t.Errorf("expected enabled for %v, from %v", g1v1rEnabled, config)
-	}
-	if !config.ResourceEnabled(g1v2rUnspecified) {
-		t.Errorf("expected enabled for %v, from %v", g1v2rUnspecified, config)
-	}
-	if !config.ResourceEnabled(g1v2rEnabled) {
-		t.Errorf("expected enabled for %v, from %v", g1v2rEnabled, config)
-	}
-	if !config.ResourceEnabled(g2v1rUnspecified) {
-		t.Errorf("expected enabled for %v, from %v", g2v1rUnspecified, config)
-	}
-	if !config.ResourceEnabled(g2v1rEnabled) {
-		t.Errorf("expected enabled for %v, from %v", g2v1rEnabled, config)
-	}
-
-	// previously disabled resources are still disabled
-	if config.ResourceEnabled(g1v1rDisabled) {
-		t.Errorf("expected disabled for %v, from %v", g1v1rDisabled, config)
-	}
-	if config.ResourceEnabled(g1v2rDisabled) {
-		t.Errorf("expected disabled for %v, from %v", g1v2rDisabled, config)
-	}
-	if config.ResourceEnabled(g2v1rDisabled) {
-		t.Errorf("expected disabled for %v, from %v", g2v1rDisabled, config)
-	}
 }
 
 func TestAnyVersionForGroupEnabled(t *testing.T) {
@@ -192,13 +140,39 @@ func TestAnyVersionForGroupEnabled(t *testing.T) {
 			},
 			testGroup: "one",
 
+			expectedResult: true,
+		},
+		{
+			name: "present, and one resource enabled",
+			creator: func() APIResourceConfigSource {
+				ret := NewResourceConfig()
+				ret.DisableVersions(schema.GroupVersion{Group: "one", Version: "version1"})
+				ret.EnableResources(schema.GroupVersionResource{Group: "one", Version: "version2", Resource: "foo"})
+				return ret
+			},
+			testGroup: "one",
+
+			expectedResult: true,
+		},
+		{
+			name: "present, and one resource under disabled version enabled",
+			creator: func() APIResourceConfigSource {
+				ret := NewResourceConfig()
+				ret.DisableVersions(schema.GroupVersion{Group: "one", Version: "version1"})
+				ret.EnableResources(schema.GroupVersionResource{Group: "one", Version: "version1", Resource: "foo"})
+				return ret
+			},
+			testGroup: "one",
+
 			expectedResult: true,
 		},
 	}
 
 	for _, tc := range tests {
-		if e, a := tc.expectedResult, tc.creator().AnyVersionForGroupEnabled(tc.testGroup); e != a {
-			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
-		}
+		t.Run(tc.name, func(t *testing.T) {
+			if e, a := tc.expectedResult, tc.creator().AnyResourceForGroupEnabled(tc.testGroup); e != a {
+				t.Errorf("expected %v, got %v", e, a)
+			}
+		})
 	}
 }

staging/src/k8s.io/apiserver/pkg/server/storage/storage_factory.go

@@ -240,7 +240,7 @@ func getAllResourcesAlias(resource schema.GroupResource) schema.GroupResource {
 
 func (s *DefaultStorageFactory) getStorageGroupResource(groupResource schema.GroupResource) schema.GroupResource {
 	for _, potentialStorageResource := range s.Overrides[groupResource].cohabitatingResources {
-		if s.APIResourceConfigSource.AnyVersionForGroupEnabled(potentialStorageResource.Group) {
+		if s.APIResourceConfigSource.AnyResourceForGroupEnabled(potentialStorageResource.Group) {
 			return potentialStorageResource
 		}
 	}