Environment

While upgrading OpenShift 3.5 to 3.6 we see that

# curl https://<master-fqdn>/healthz
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "User \"system:anonymous\" cannot \"get\" on \"/healthz\"",
  "reason": "Forbidden",
  "details": {},
  "code": 403
}

This is an error. In atomic-openshift-master-api logs we can see messages similar to

<date> <time> <master_fqdn> atomic-openshift-master-api[87060]: I0315 15:37:01.534660   87060 round_trippers.go:405] GET <master_url>/apis/authorization.openshift.io/v1/policies?resourceVersion=0 404 Not Found in 0 milliseconds

and

<date> <time> <master_fqdn> atomic-openshift-master-api[<pid>]: E0315 <timestamp>  <pid> reflector.go:201] github.com/openshift/origin/pkg/authorization/generated/informers /internalversion/factory.go:45: Failed to list *authorization.Policy: the server could not find the requested resource