diff --git a/pkg/oc/admin/diagnostics/diagnostics/client/config_contexts.go b/pkg/oc/admin/diagnostics/diagnostics/client/config_contexts.go
index a5569a433baf..90f3e204e96b 100644
--- a/pkg/oc/admin/diagnostics/diagnostics/client/config_contexts.go
+++ b/pkg/oc/admin/diagnostics/diagnostics/client/config_contexts.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/openshift/origin/pkg/oc/admin/diagnostics/diagnostics/types"
 	osclientcmd "github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
 )
 
 // ConfigContext diagnostics (one per context) validate that the client config context is complete and has connectivity to the master.
@@ -235,26 +236,30 @@ func (d ConfigContext) Check() types.DiagnosticResult {
 
 	// Actually send a request to see if context has connectivity.
 	// Note: we cannot reuse factories as they cache the clients, so build new factory for each context.
-	projectClient, err := osclientcmd.NewFactory(kclientcmd.NewDefaultClientConfig(*d.RawConfig, &kclientcmd.ConfigOverrides{Context: *context})).OpenshiftInternalProjectClient()
-	// client create now *fails* if cannot connect to server; so, address connectivity errors below
+	temporaryFactory := osclientcmd.NewFactory(kclientcmd.NewDefaultClientConfig(*d.RawConfig, &kclientcmd.ConfigOverrides{Context: *context}))
+	clientConfig, err := temporaryFactory.ClientConfig()
 	if err == nil {
-		if projects, projerr := projectClient.Project().Projects().List(metav1.ListOptions{}); projerr != nil {
-			err = projerr
-		} else { // success!
-			list := []string{}
-			for i, project := range projects.Items {
-				if i > 9 {
-					list = append(list, "...")
-					break
+		projectClient, err := projectclientinternal.NewForConfig(clientConfig)
+		// client create now *fails* if cannot connect to server; so, address connectivity errors below
+		if err == nil {
+			if projects, projerr := projectClient.Project().Projects().List(metav1.ListOptions{}); projerr != nil {
+				err = projerr
+			} else { // success!
+				list := []string{}
+				for i, project := range projects.Items {
+					if i > 9 {
+						list = append(list, "...")
+						break
+					}
+					list = append(list, project.Name)
 				}
-				list = append(list, project.Name)
-			}
-			if len(list) == 0 {
-				r.Info("DCli0003", msgText+"Successfully requested project list, but it is empty, so user has no access to anything.")
-			} else {
-				r.Info("DCli0004", msgText+fmt.Sprintf("Successfully requested project list; has access to project(s):\n  %v", list))
+				if len(list) == 0 {
+					r.Info("DCli0003", msgText+"Successfully requested project list, but it is empty, so user has no access to anything.")
+				} else {
+					r.Info("DCli0004", msgText+fmt.Sprintf("Successfully requested project list; has access to project(s):\n  %v", list))
+				}
+				return r
 			}
-			return r
 		}
 	}
 
diff --git a/pkg/oc/admin/diagnostics/diagnostics/cluster/network/in_pod/cmd.go b/pkg/oc/admin/diagnostics/diagnostics/cluster/network/in_pod/cmd.go
index 556abe57ba40..39181b740170 100644
--- a/pkg/oc/admin/diagnostics/diagnostics/cluster/network/in_pod/cmd.go
+++ b/pkg/oc/admin/diagnostics/diagnostics/cluster/network/in_pod/cmd.go
@@ -11,6 +11,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
 
+	networkclientinternal "github.com/openshift/origin/pkg/network/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/admin/diagnostics/diagnostics/log"
 	"github.com/openshift/origin/pkg/oc/admin/diagnostics/diagnostics/types"
 	"github.com/openshift/origin/pkg/oc/admin/diagnostics/options"
@@ -123,7 +124,11 @@ func (o NetworkPodDiagnosticsOptions) buildNetworkPodDiagnostics() ([]types.Diag
 	if clientErr != nil {
 		return nil, clientErr
 	}
-	networkClient, err := factory.OpenshiftInternalNetworkClient()
+	clientConfig, err := factory.ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+	networkClient, err := networkclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/oc/admin/groups/changemembership.go b/pkg/oc/admin/groups/changemembership.go
index cb59aaa0d02d..9e404eeb62ad 100644
--- a/pkg/oc/admin/groups/changemembership.go
+++ b/pkg/oc/admin/groups/changemembership.go
@@ -13,6 +13,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	usertypedclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -102,7 +103,11 @@ func (o *GroupModificationOptions) Complete(f *clientcmd.Factory, args []string)
 	o.Group = args[0]
 	o.Users = append(o.Users, args[1:]...)
 
-	userClient, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	userClient, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/groups/new.go b/pkg/oc/admin/groups/new.go
index 1e6e30075457..16e9aa6604f1 100644
--- a/pkg/oc/admin/groups/new.go
+++ b/pkg/oc/admin/groups/new.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	userapi "github.com/openshift/origin/pkg/user/apis/user"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	usertypedclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -79,7 +80,11 @@ func (o *NewGroupOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, arg
 		o.Users = append(o.Users, args[1:]...)
 	}
 
-	userClient, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	userClient, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/groups/sync/cli/prune.go b/pkg/oc/admin/groups/sync/cli/prune.go
index 1a39809dcf49..5a139e2162b9 100644
--- a/pkg/oc/admin/groups/sync/cli/prune.go
+++ b/pkg/oc/admin/groups/sync/cli/prune.go
@@ -19,6 +19,7 @@ import (
 	"github.com/openshift/origin/pkg/oauthserver/ldaputil/ldapclient"
 	"github.com/openshift/origin/pkg/oc/admin/groups/sync"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	usertypedclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -148,7 +149,11 @@ func (o *PruneOptions) Complete(whitelistFile, blacklistFile, configFile string,
 		return err
 	}
 
-	userClient, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	userClient, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/groups/sync/cli/sync.go b/pkg/oc/admin/groups/sync/cli/sync.go
index 0fbe20c06cfb..2ee3952b0c54 100644
--- a/pkg/oc/admin/groups/sync/cli/sync.go
+++ b/pkg/oc/admin/groups/sync/cli/sync.go
@@ -29,6 +29,7 @@ import (
 	"github.com/openshift/origin/pkg/oc/admin/groups/sync/interfaces"
 	"github.com/openshift/origin/pkg/oc/admin/groups/sync/syncerror"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	usertypedclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -221,7 +222,11 @@ func (o *SyncOptions) Complete(typeArg, whitelistFile, blacklistFile, configFile
 		}
 	}
 
-	userClient, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	userClient, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/image/verify-signature.go b/pkg/oc/admin/image/verify-signature.go
index 7571bb022642..79272909236c 100644
--- a/pkg/oc/admin/image/verify-signature.go
+++ b/pkg/oc/admin/image/verify-signature.go
@@ -23,8 +23,10 @@ import (
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imageclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 )
 
 var (
@@ -147,13 +149,17 @@ func (o *VerifyImageSignatureOptions) Complete(f *clientcmd.Factory, cmd *cobra.
 			return fmt.Errorf("unable to read --public-key: %v", err)
 		}
 	}
-	imageClient, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	imageClient, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
 	o.ImageClient = imageClient.Image()
 
-	userClient, err := f.OpenshiftInternalUserClient()
+	userClient, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/migrate/images/imagerefs.go b/pkg/oc/admin/migrate/images/imagerefs.go
index 3e244ef400c4..1156d410302e 100644
--- a/pkg/oc/admin/migrate/images/imagerefs.go
+++ b/pkg/oc/admin/migrate/images/imagerefs.go
@@ -21,6 +21,7 @@ import (
 	"github.com/openshift/origin/pkg/oc/admin/migrate"
 
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imagetypedclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -131,7 +132,11 @@ func (o *MigrateImageReferenceOptions) Complete(f *clientcmd.Factory, c *cobra.C
 		return err
 	}
 
-	imageClient, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	imageClient, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/network/project_options.go b/pkg/oc/admin/network/project_options.go
index a948329b1372..35c2412282b7 100644
--- a/pkg/oc/admin/network/project_options.go
+++ b/pkg/oc/admin/network/project_options.go
@@ -22,14 +22,14 @@ import (
 
 	"github.com/openshift/origin/pkg/network"
 	networkapi "github.com/openshift/origin/pkg/network/apis/network"
-	networkclient "github.com/openshift/origin/pkg/network/generated/internalclientset"
+	networkclientinternal "github.com/openshift/origin/pkg/network/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	projectapi "github.com/openshift/origin/pkg/project/apis/project"
 )
 
 type ProjectOptions struct {
 	DefaultNamespace string
-	Oclient          networkclient.Interface
+	Oclient          networkclientinternal.Interface
 	Kclient          kclientset.Interface
 	Out              io.Writer
 
@@ -53,7 +53,11 @@ func (p *ProjectOptions) Complete(f *clientcmd.Factory, c *cobra.Command, args [
 	if err != nil {
 		return err
 	}
-	networkClient, err := f.OpenshiftInternalNetworkClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	networkClient, err := networkclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/cani.go b/pkg/oc/admin/policy/cani.go
index f9bd854f372a..040f1d23a6aa 100644
--- a/pkg/oc/admin/policy/cani.go
+++ b/pkg/oc/admin/policy/cani.go
@@ -18,6 +18,7 @@ import (
 	"k8s.io/kubernetes/pkg/printers"
 
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	oauthorizationtypedclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset/typed/authorization/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -120,8 +121,11 @@ func (o *canIOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory, args []
 		}
 	}
 
-	var err error
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/modify_roles.go b/pkg/oc/admin/policy/modify_roles.go
index 2fb27b9de578..79f14774477c 100644
--- a/pkg/oc/admin/policy/modify_roles.go
+++ b/pkg/oc/admin/policy/modify_roles.go
@@ -17,6 +17,7 @@ import (
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
 
@@ -340,7 +341,11 @@ func (o *RoleModificationOptions) CompleteUserWithSA(f *clientcmd.Factory, cmd *
 		}
 	}
 
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
@@ -380,7 +385,11 @@ func (o *RoleModificationOptions) Complete(f *clientcmd.Factory, cmd *cobra.Comm
 
 	o.Targets = *target
 
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/modify_scc.go b/pkg/oc/admin/policy/modify_scc.go
index 73a0addca807..cdab574d072e 100644
--- a/pkg/oc/admin/policy/modify_scc.go
+++ b/pkg/oc/admin/policy/modify_scc.go
@@ -15,6 +15,7 @@ import (
 
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
 	securitytypedclient "github.com/openshift/origin/pkg/security/generated/internalclientset/typed/security/internalversion"
 )
 
@@ -168,7 +169,11 @@ func (o *SCCModificationOptions) CompleteUsers(f *clientcmd.Factory, cmd *cobra.
 		return kcmdutil.PrintObject(cmd, obj, out)
 	}
 
-	securityClient, err := f.OpenshiftInternalSecurityClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
@@ -204,7 +209,11 @@ func (o *SCCModificationOptions) CompleteGroups(f *clientcmd.Factory, cmd *cobra
 
 	o.DryRun = kcmdutil.GetFlagBool(cmd, "dry-run")
 
-	securityClient, err := f.OpenshiftInternalSecurityClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/reconcile_clusterrolebindings.go b/pkg/oc/admin/policy/reconcile_clusterrolebindings.go
index 47eaf4168e3c..524d908b9778 100644
--- a/pkg/oc/admin/policy/reconcile_clusterrolebindings.go
+++ b/pkg/oc/admin/policy/reconcile_clusterrolebindings.go
@@ -19,6 +19,7 @@ import (
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	authorizationtypedclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset/typed/authorization/internalversion"
 	"github.com/openshift/origin/pkg/authorization/registry/util"
 	authorizationutil "github.com/openshift/origin/pkg/authorization/util"
@@ -119,7 +120,11 @@ func NewCmdReconcileClusterRoleBindings(name, fullName string, f *clientcmd.Fact
 }
 
 func (o *ReconcileClusterRoleBindingsOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory, args []string, excludeUsers, excludeGroups []string) error {
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/reconcile_clusterroles.go b/pkg/oc/admin/policy/reconcile_clusterroles.go
index e5b3d1db63bd..4768006d75ac 100644
--- a/pkg/oc/admin/policy/reconcile_clusterroles.go
+++ b/pkg/oc/admin/policy/reconcile_clusterroles.go
@@ -18,6 +18,7 @@ import (
 	rbacregistryvalidation "k8s.io/kubernetes/pkg/registry/rbac/validation"
 
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	authorizationtypedclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset/typed/authorization/internalversion"
 	"github.com/openshift/origin/pkg/authorization/registry/util"
 	"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
@@ -113,7 +114,11 @@ func NewCmdReconcileClusterRoles(name, fullName string, f *clientcmd.Factory, ou
 }
 
 func (o *ReconcileClusterRolesOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory, args []string) error {
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/reconcile_sccs.go b/pkg/oc/admin/policy/reconcile_sccs.go
index 87f6e5b8ecac..903f46ee8788 100644
--- a/pkg/oc/admin/policy/reconcile_sccs.go
+++ b/pkg/oc/admin/policy/reconcile_sccs.go
@@ -22,6 +22,7 @@ import (
 	cmdutil "github.com/openshift/origin/pkg/cmd/util"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	securityapi "github.com/openshift/origin/pkg/security/apis/security"
+	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
 	securitytypedclient "github.com/openshift/origin/pkg/security/generated/internalclientset/typed/security/internalversion"
 )
 
@@ -120,7 +121,11 @@ func (o *ReconcileSCCOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory,
 	if err != nil {
 		return err
 	}
-	securityClient, err := f.OpenshiftInternalSecurityClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/remove_from_project.go b/pkg/oc/admin/policy/remove_from_project.go
index 88568a3c87b6..c498eed15447 100644
--- a/pkg/oc/admin/policy/remove_from_project.go
+++ b/pkg/oc/admin/policy/remove_from_project.go
@@ -14,6 +14,7 @@ import (
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	oauthorizationtypedclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset/typed/authorization/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -103,7 +104,11 @@ func (o *RemoveFromProjectOptions) Complete(f *clientcmd.Factory, cmd *cobra.Com
 
 	*target = append(*target, args...)
 
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/policy/review.go b/pkg/oc/admin/policy/review.go
index 9199ddfcb109..a89c6b17290a 100644
--- a/pkg/oc/admin/policy/review.go
+++ b/pkg/oc/admin/policy/review.go
@@ -24,6 +24,7 @@ import (
 	ometa "github.com/openshift/origin/pkg/api/meta"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	securityapi "github.com/openshift/origin/pkg/security/apis/security"
+	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
 	securitytypedclient "github.com/openshift/origin/pkg/security/generated/internalclientset/typed/security/internalversion"
 )
 
@@ -103,7 +104,11 @@ func (o *sccReviewOptions) Complete(f *clientcmd.Factory, args []string, cmd *co
 	if err != nil {
 		return err
 	}
-	securityClient, err := f.OpenshiftInternalSecurityClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return fmt.Errorf("unable to obtain client: %v", err)
 	}
diff --git a/pkg/oc/admin/policy/subject_review.go b/pkg/oc/admin/policy/subject_review.go
index 60e7dce2fc11..c8ac1db63c56 100644
--- a/pkg/oc/admin/policy/subject_review.go
+++ b/pkg/oc/admin/policy/subject_review.go
@@ -22,6 +22,7 @@ import (
 	securityapiv1 "github.com/openshift/api/security/v1"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	securityapi "github.com/openshift/origin/pkg/security/apis/security"
+	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
 	securitytypedclient "github.com/openshift/origin/pkg/security/generated/internalclientset/typed/security/internalversion"
 )
 
@@ -103,7 +104,11 @@ func (o *sccSubjectReviewOptions) Complete(f *clientcmd.Factory, args []string,
 	if err != nil {
 		return err
 	}
-	securityClient, err := f.OpenshiftInternalSecurityClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return fmt.Errorf("unable to obtain client: %v", err)
 	}
diff --git a/pkg/oc/admin/policy/who_can.go b/pkg/oc/admin/policy/who_can.go
index 0db592c9c438..1d7121e091f7 100644
--- a/pkg/oc/admin/policy/who_can.go
+++ b/pkg/oc/admin/policy/who_can.go
@@ -18,6 +18,7 @@ import (
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	oauthorizationtypedclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset/typed/authorization/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -81,7 +82,11 @@ func (o *whoCanOptions) complete(f *clientcmd.Factory, cmd *cobra.Command, args
 		return errors.New("you must specify two or three arguments: verb, resource, and optional resourceName")
 	}
 
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/project/new_project.go b/pkg/oc/admin/project/new_project.go
index f146f311ce4a..d8a78070a954 100644
--- a/pkg/oc/admin/project/new_project.go
+++ b/pkg/oc/admin/project/new_project.go
@@ -18,12 +18,14 @@ import (
 
 	oapi "github.com/openshift/origin/pkg/api"
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	authorizationtypedclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset/typed/authorization/internalversion"
 	authorizationregistryutil "github.com/openshift/origin/pkg/authorization/registry/util"
 	"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
 	"github.com/openshift/origin/pkg/oc/admin/policy"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	projectapi "github.com/openshift/origin/pkg/project/apis/project"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
 	projectclient "github.com/openshift/origin/pkg/project/generated/internalclientset/typed/project/internalversion"
 )
 
@@ -91,12 +93,16 @@ func (o *NewProjectOptions) complete(f *clientcmd.Factory, args []string) error
 
 	o.ProjectName = args[0]
 
-	projectClient, err := f.OpenshiftInternalProjectClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	projectClient, err := projectclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
 	o.ProjectClient = projectClient.Project()
-	authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
+	authorizationClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/prune/deployments.go b/pkg/oc/admin/prune/deployments.go
index 13918722929d..632b9d99d20a 100644
--- a/pkg/oc/admin/prune/deployments.go
+++ b/pkg/oc/admin/prune/deployments.go
@@ -48,7 +48,7 @@ type PruneDeploymentsOptions struct {
 	Namespace       string
 
 	AppsClient appsclientinternal.DeploymentConfigsGetter
-	KClient    kclientset.Interface
+	KubeClient kclientset.Interface
 	Out        io.Writer
 }
 
@@ -99,16 +99,20 @@ func (o *PruneDeploymentsOptions) Complete(f *clientcmd.Factory, cmd *cobra.Comm
 	}
 	o.Out = out
 
-	kClient, err := f.ClientSet()
+	kubeClient, err := f.ClientSet()
 	if err != nil {
 		return err
 	}
-	appsClient, err := f.OpenshiftInternalAppsClient()
+	clientConfig, err := f.ClientConfig()
 	if err != nil {
 		return err
 	}
-	o.AppsClient = appsClient.Apps()
-	o.KClient = kClient
+	appsClient, err := appsclientinternal.NewForConfig(clientConfig)
+	if err != nil {
+		return err
+	}
+	o.AppsClient = appsClient
+	o.KubeClient = kubeClient
 
 	return nil
 }
@@ -138,7 +142,7 @@ func (o PruneDeploymentsOptions) Run() error {
 		deploymentConfigs = append(deploymentConfigs, &deploymentConfigList.Items[i])
 	}
 
-	deploymentList, err := o.KClient.Core().ReplicationControllers(o.Namespace).List(metav1.ListOptions{})
+	deploymentList, err := o.KubeClient.Core().ReplicationControllers(o.Namespace).List(metav1.ListOptions{})
 	if err != nil {
 		return err
 	}
@@ -163,7 +167,7 @@ func (o PruneDeploymentsOptions) Run() error {
 	deploymentDeleter := &describingDeploymentDeleter{w: w}
 
 	if o.Confirm {
-		deploymentDeleter.delegate = prune.NewDeploymentDeleter(o.KClient.Core(), o.KClient.Core())
+		deploymentDeleter.delegate = prune.NewDeploymentDeleter(o.KubeClient.Core(), o.KubeClient.Core())
 	} else {
 		fmt.Fprintln(os.Stderr, "Dry run enabled - no modifications will be made. Add --confirm to remove deployments")
 	}
diff --git a/pkg/oc/admin/prune/deployments_test.go b/pkg/oc/admin/prune/deployments_test.go
index a28279338f8c..777e3bcd3e82 100644
--- a/pkg/oc/admin/prune/deployments_test.go
+++ b/pkg/oc/admin/prune/deployments_test.go
@@ -15,7 +15,7 @@ func TestDeploymentPruneNamespaced(t *testing.T) {
 		Namespace: "foo",
 
 		AppsClient: osFake.Apps(),
-		KClient:    kFake,
+		KubeClient: kFake,
 		Out:        ioutil.Discard,
 	}
 
diff --git a/pkg/oc/admin/router/router.go b/pkg/oc/admin/router/router.go
index 847de3bb45c7..32ab296b44b9 100644
--- a/pkg/oc/admin/router/router.go
+++ b/pkg/oc/admin/router/router.go
@@ -33,7 +33,7 @@ import (
 	configcmd "github.com/openshift/origin/pkg/bulk"
 	"github.com/openshift/origin/pkg/cmd/util/variable"
 	"github.com/openshift/origin/pkg/oc/generate/app"
-	securityclient "github.com/openshift/origin/pkg/security/generated/internalclientset"
+	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
 	oscc "github.com/openshift/origin/pkg/security/securitycontextconstraints"
 	fileutil "github.com/openshift/origin/pkg/util/file"
 )
@@ -611,7 +611,11 @@ func RunCmdRouter(f *clientcmd.Factory, cmd *cobra.Command, out, errout io.Write
 	}
 
 	if !cfg.Local {
-		securityClient, err := f.OpenshiftInternalSecurityClient()
+		clientConfig, err := f.ClientConfig()
+		if err != nil {
+			return err
+		}
+		securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return err
 		}
@@ -886,7 +890,7 @@ func generateStatsPassword() string {
 	return strings.Join(password, "")
 }
 
-func validateServiceAccount(client securityclient.Interface, ns string, serviceAccount string, hostNetwork, hostPorts bool) error {
+func validateServiceAccount(client securityclientinternal.Interface, ns string, serviceAccount string, hostNetwork, hostPorts bool) error {
 	if !hostNetwork && !hostPorts {
 		return nil
 	}
diff --git a/pkg/oc/admin/top/images.go b/pkg/oc/admin/top/images.go
index 0a6f9658948b..c774a69c397e 100644
--- a/pkg/oc/admin/top/images.go
+++ b/pkg/oc/admin/top/images.go
@@ -18,6 +18,7 @@ import (
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
 	buildapi "github.com/openshift/origin/pkg/build/apis/build"
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	"github.com/openshift/origin/pkg/oc/graph/genericgraph"
 	imagegraph "github.com/openshift/origin/pkg/oc/graph/imagegraph/nodes"
@@ -77,7 +78,11 @@ func (o *TopImagesOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, ar
 		return err
 	}
 
-	imageClient, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	imageClient, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/admin/top/imagestreams.go b/pkg/oc/admin/top/imagestreams.go
index e42238446638..947de4516249 100644
--- a/pkg/oc/admin/top/imagestreams.go
+++ b/pkg/oc/admin/top/imagestreams.go
@@ -17,6 +17,7 @@ import (
 	"github.com/openshift/origin/pkg/oc/graph/genericgraph"
 
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	imagegraph "github.com/openshift/origin/pkg/oc/graph/imagegraph/nodes"
 )
@@ -70,7 +71,11 @@ func (o *TopImageStreamsOptions) Complete(f *clientcmd.Factory, cmd *cobra.Comma
 		namespace = metav1.NamespaceAll
 	}
 	o.out = out
-	imageClient, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	imageClient, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/bootstrap/docker/openshift/project.go b/pkg/oc/bootstrap/docker/openshift/project.go
index e6039b029097..93d1264db565 100644
--- a/pkg/oc/bootstrap/docker/openshift/project.go
+++ b/pkg/oc/bootstrap/docker/openshift/project.go
@@ -10,11 +10,16 @@ import (
 	"github.com/openshift/origin/pkg/oc/cli/cmd"
 	"github.com/openshift/origin/pkg/oc/cli/config"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
 )
 
 // CreateProject creates a project
 func CreateProject(f *clientcmd.Factory, name, display, desc, basecmd string, out io.Writer) error {
-	projectClient, err := f.OpenshiftInternalProjectClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	projectClient, err := projectclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cli.go b/pkg/oc/cli/cli.go
index 30b91e643267..67cf8339db86 100644
--- a/pkg/oc/cli/cli.go
+++ b/pkg/oc/cli/cli.go
@@ -12,6 +12,7 @@ import (
 	kubecmd "k8s.io/kubernetes/pkg/kubectl/cmd"
 	ktemplates "k8s.io/kubernetes/pkg/kubectl/cmd/templates"
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
 
 	"github.com/openshift/origin/pkg/cmd/flagtypes"
 	"github.com/openshift/origin/pkg/cmd/templates"
@@ -315,6 +316,9 @@ func CommandFor(basename string) *cobra.Command {
 	case "kubectl":
 		cmd = kubecmd.NewKubectlCommand(kcmdutil.NewFactory(nil), in, out, errout)
 	default:
+		// we only need this change for `oc`.  `kubectl` should behave as close to `kubectl` as we can
+		resource.OAPIToGroupified = OAPIToGroupified
+		kcmdutil.OAPIToGroupifiedGVK = OAPIToGroupifiedGVK
 		cmd = NewCommandCLI("oc", "oc", in, out, errout)
 	}
 
diff --git a/pkg/oc/cli/cmd/buildlogs.go b/pkg/oc/cli/cmd/buildlogs.go
index 99858d9884d8..7cefecb82b85 100644
--- a/pkg/oc/cli/cmd/buildlogs.go
+++ b/pkg/oc/cli/cmd/buildlogs.go
@@ -15,6 +15,7 @@ import (
 
 	buildapi "github.com/openshift/origin/pkg/build/apis/build"
 	buildmanualclient "github.com/openshift/origin/pkg/build/client/internalversion"
+	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
 	buildutil "github.com/openshift/origin/pkg/build/util"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -83,7 +84,11 @@ func RunBuildLogs(fullName string, f *clientcmd.Factory, out io.Writer, cmd *cob
 		return err
 	}
 
-	buildClient, err := f.OpenshiftInternalBuildClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	buildClient, err := buildclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/clusterquota.go b/pkg/oc/cli/cmd/create/clusterquota.go
index dfc24adb511d..24e322ecb8e5 100644
--- a/pkg/oc/cli/cmd/create/clusterquota.go
+++ b/pkg/oc/cli/cmd/create/clusterquota.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	quotaapi "github.com/openshift/origin/pkg/quota/apis/quota"
+	quotaclientinternal "github.com/openshift/origin/pkg/quota/generated/internalclientset"
 	quotaclient "github.com/openshift/origin/pkg/quota/generated/internalclientset/typed/quota/internalversion"
 )
 
@@ -117,7 +118,11 @@ func (o *CreateClusterQuotaOptions) Complete(cmd *cobra.Command, f *clientcmd.Fa
 		}
 		o.ClusterQuota.Spec.Quota.Hard[kapi.ResourceName(tokens[0])] = quantity
 	}
-	quotaClient, err := f.OpenshiftInternalQuotaClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	quotaClient, err := quotaclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/deploymentconfig.go b/pkg/oc/cli/cmd/create/deploymentconfig.go
index 88f308fc60fe..8b83db19973f 100644
--- a/pkg/oc/cli/cmd/create/deploymentconfig.go
+++ b/pkg/oc/cli/cmd/create/deploymentconfig.go
@@ -13,6 +13,7 @@ import (
 	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	appsinternalversion "github.com/openshift/origin/pkg/apps/generated/internalclientset/typed/apps/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -104,7 +105,11 @@ func (o *CreateDeploymentConfigOptions) Complete(cmd *cobra.Command, f *clientcm
 		return err
 	}
 
-	appsClient, err := f.OpenshiftInternalAppsClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	appsClient, err := appsclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/identity.go b/pkg/oc/cli/cmd/create/identity.go
index 4a03c851cbe8..df93b5b02f31 100644
--- a/pkg/oc/cli/cmd/create/identity.go
+++ b/pkg/oc/cli/cmd/create/identity.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	userapi "github.com/openshift/origin/pkg/user/apis/user"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	userclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -85,7 +86,11 @@ func (o *CreateIdentityOptions) Complete(cmd *cobra.Command, f *clientcmd.Factor
 
 	o.DryRun = cmdutil.GetFlagBool(cmd, "dry-run")
 
-	client, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/imagestream.go b/pkg/oc/cli/cmd/create/imagestream.go
index ed29b420d483..4f3fc21cba3d 100644
--- a/pkg/oc/cli/cmd/create/imagestream.go
+++ b/pkg/oc/cli/cmd/create/imagestream.go
@@ -12,6 +12,7 @@ import (
 	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imageclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -94,7 +95,11 @@ func (o *CreateImageStreamOptions) Complete(cmd *cobra.Command, f *clientcmd.Fac
 		return err
 	}
 
-	client, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/imagestreamtag.go b/pkg/oc/cli/cmd/create/imagestreamtag.go
index 2c4931d62383..06826d1be38a 100644
--- a/pkg/oc/cli/cmd/create/imagestreamtag.go
+++ b/pkg/oc/cli/cmd/create/imagestreamtag.go
@@ -14,6 +14,7 @@ import (
 	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imageclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	utilenv "github.com/openshift/origin/pkg/oc/util/env"
@@ -119,7 +120,11 @@ func (o *CreateImageStreamTagOptions) Complete(cmd *cobra.Command, f *clientcmd.
 		return err
 	}
 
-	client, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/route.go b/pkg/oc/cli/cmd/create/route.go
index c917aca2c392..ccc11ccd465e 100644
--- a/pkg/oc/cli/cmd/create/route.go
+++ b/pkg/oc/cli/cmd/create/route.go
@@ -13,6 +13,7 @@ import (
 	cmdutil "github.com/openshift/origin/pkg/cmd/util"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	routeapi "github.com/openshift/origin/pkg/route/apis/route"
+	routeclientinternal "github.com/openshift/origin/pkg/route/generated/internalclientset"
 	fileutil "github.com/openshift/origin/pkg/util/file"
 )
 
@@ -95,7 +96,11 @@ func CreateEdgeRoute(f *clientcmd.Factory, out io.Writer, cmd *cobra.Command, ar
 	if err != nil {
 		return err
 	}
-	routeClient, err := f.OpenshiftInternalRouteClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	routeClient, err := routeclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
@@ -210,7 +215,11 @@ func CreatePassthroughRoute(f *clientcmd.Factory, out io.Writer, cmd *cobra.Comm
 	if err != nil {
 		return err
 	}
-	routeClient, err := f.OpenshiftInternalRouteClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	routeClient, err := routeclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
@@ -319,7 +328,11 @@ func CreateReencryptRoute(f *clientcmd.Factory, out io.Writer, cmd *cobra.Comman
 	if err != nil {
 		return err
 	}
-	routeClient, err := f.OpenshiftInternalRouteClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	routeClient, err := routeclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/user.go b/pkg/oc/cli/cmd/create/user.go
index 168c4533bfe4..fbbab3707e49 100644
--- a/pkg/oc/cli/cmd/create/user.go
+++ b/pkg/oc/cli/cmd/create/user.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	userapi "github.com/openshift/origin/pkg/user/apis/user"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	userclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -79,7 +80,11 @@ func (o *CreateUserOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory, a
 
 	o.DryRun = cmdutil.GetFlagBool(cmd, "dry-run")
 
-	client, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/create/user_identity_mapping.go b/pkg/oc/cli/cmd/create/user_identity_mapping.go
index d01f3af64529..6e424501c23a 100644
--- a/pkg/oc/cli/cmd/create/user_identity_mapping.go
+++ b/pkg/oc/cli/cmd/create/user_identity_mapping.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	userapi "github.com/openshift/origin/pkg/user/apis/user"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	userclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -78,7 +79,11 @@ func (o *CreateUserIdentityMappingOptions) Complete(cmd *cobra.Command, f *clien
 
 	o.DryRun = cmdutil.GetFlagBool(cmd, "dry-run")
 
-	client, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/debug.go b/pkg/oc/cli/cmd/debug.go
index 6fdd04b0df07..29851ab7f2cf 100644
--- a/pkg/oc/cli/cmd/debug.go
+++ b/pkg/oc/cli/cmd/debug.go
@@ -27,8 +27,10 @@ import (
 	"k8s.io/kubernetes/pkg/util/interrupt"
 
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	appsclient "github.com/openshift/origin/pkg/apps/generated/internalclientset/typed/apps/internalversion"
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imageclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	generateapp "github.com/openshift/origin/pkg/oc/generate/app"
@@ -300,13 +302,13 @@ func (o *DebugOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory, args [
 	}
 	o.Attach.PodClient = kc.Core()
 
-	appsClient, err := f.OpenshiftInternalAppsClient()
+	appsClient, err := appsclientinternal.NewForConfig(config)
 	if err != nil {
 		return err
 	}
 	o.AppsClient = appsClient.Apps()
 
-	imageClient, err := f.OpenshiftInternalImageClient()
+	imageClient, err := imageclientinternal.NewForConfig(config)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/deploy.go b/pkg/oc/cli/cmd/deploy.go
index 606c94dbf287..dabf0187beb1 100644
--- a/pkg/oc/cli/cmd/deploy.go
+++ b/pkg/oc/cli/cmd/deploy.go
@@ -23,6 +23,7 @@ import (
 
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
 	appsinternalclient "github.com/openshift/origin/pkg/apps/client/internalversion"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	appsclient "github.com/openshift/origin/pkg/apps/generated/internalclientset/typed/apps/internalversion"
 	appsutil "github.com/openshift/origin/pkg/apps/util"
 	"github.com/openshift/origin/pkg/oc/cli/describe"
@@ -145,7 +146,11 @@ func (o *DeployOptions) Complete(f *clientcmd.Factory, args []string, out io.Wri
 	if err != nil {
 		return err
 	}
-	client, err := f.OpenshiftInternalAppsClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := appsclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/idle.go b/pkg/oc/cli/cmd/idle.go
index bad26f6642a6..9ae8e6bcf8d5 100644
--- a/pkg/oc/cli/cmd/idle.go
+++ b/pkg/oc/cli/cmd/idle.go
@@ -25,6 +25,7 @@ import (
 
 	appsv1client "github.com/openshift/client-go/apps/clientset/versioned/typed/apps/v1"
 	appsmanualclient "github.com/openshift/origin/pkg/apps/client/v1"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	unidlingapi "github.com/openshift/origin/pkg/unidling/api"
 	utilunidling "github.com/openshift/origin/pkg/unidling/util"
@@ -555,11 +556,11 @@ func (o *IdleOptions) RunIdle(f *clientcmd.Factory) error {
 	if err != nil {
 		return err
 	}
-	appClient, err := f.OpenshiftInternalAppsClient()
+	clientConfig, err := f.ClientConfig()
 	if err != nil {
 		return err
 	}
-	clientConfig, err := f.ClientConfig()
+	appClient, err := appsclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/importer/appjson.go b/pkg/oc/cli/cmd/importer/appjson.go
index 5ec12b6d7142..90aaca5212bf 100644
--- a/pkg/oc/cli/cmd/importer/appjson.go
+++ b/pkg/oc/cli/cmd/importer/appjson.go
@@ -28,6 +28,7 @@ import (
 	"github.com/openshift/origin/pkg/oc/generate/appjson"
 	appcmd "github.com/openshift/origin/pkg/oc/generate/cmd"
 	templateinternalclient "github.com/openshift/origin/pkg/template/client/internalversion"
+	templateclientinternal "github.com/openshift/origin/pkg/template/generated/internalclientset"
 	templateclient "github.com/openshift/origin/pkg/template/generated/internalclientset/typed/template/internalversion"
 )
 
@@ -137,7 +138,11 @@ func (o *AppJSONOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, args
 	}
 	o.Namespace = ns
 
-	templateClient, err := f.OpenshiftInternalTemplateClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	templateClient, err := templateclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/importimage.go b/pkg/oc/cli/cmd/importimage.go
index 166484daee90..f5ed7547b473 100644
--- a/pkg/oc/cli/cmd/importimage.go
+++ b/pkg/oc/cli/cmd/importimage.go
@@ -20,6 +20,7 @@ import (
 
 	imageapiv1 "github.com/openshift/api/image/v1"
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imageclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/describe"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
@@ -119,10 +120,15 @@ func (o *ImportImageOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command,
 	}
 	o.Namespace = namespace
 
-	client, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
 	if err != nil {
 		return err
 	}
+	client, err := imageclientinternal.NewForConfig(clientConfig)
+	if err != nil {
+		return err
+	}
+
 	o.imageClient = client.Image()
 	o.isClient = client.Image().ImageStreams(namespace)
 
diff --git a/pkg/oc/cli/cmd/logs.go b/pkg/oc/cli/cmd/logs.go
index 4c17d248f03c..dab0b26f8093 100644
--- a/pkg/oc/cli/cmd/logs.go
+++ b/pkg/oc/cli/cmd/logs.go
@@ -17,6 +17,7 @@ import (
 
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
 	buildapi "github.com/openshift/origin/pkg/build/apis/build"
+	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
 	buildclient "github.com/openshift/origin/pkg/build/generated/internalclientset/typed/build/internalversion"
 	buildutil "github.com/openshift/origin/pkg/build/util"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
@@ -139,7 +140,11 @@ func (o *OpenShiftLogsOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command
 		return errors.New("expected a resource")
 	}
 
-	client, err := f.OpenshiftInternalBuildClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := buildclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/newapp.go b/pkg/oc/cli/cmd/newapp.go
index b5a9b25b31b8..74118ec08bc8 100644
--- a/pkg/oc/cli/cmd/newapp.go
+++ b/pkg/oc/cli/cmd/newapp.go
@@ -35,12 +35,15 @@ import (
 	cmdutil "github.com/openshift/origin/pkg/cmd/util"
 	"github.com/openshift/origin/pkg/git"
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	"github.com/openshift/origin/pkg/oc/generate"
 	newapp "github.com/openshift/origin/pkg/oc/generate/app"
 	newcmd "github.com/openshift/origin/pkg/oc/generate/cmd"
 	dockerutil "github.com/openshift/origin/pkg/oc/util/docker"
 	routeapi "github.com/openshift/origin/pkg/route/apis/route"
+	routeclientinternal "github.com/openshift/origin/pkg/route/generated/internalclientset"
+	templateclientinternal "github.com/openshift/origin/pkg/template/generated/internalclientset"
 	"github.com/openshift/origin/pkg/util"
 )
 
@@ -581,15 +584,19 @@ func CompleteAppConfig(config *newcmd.AppConfig, f *clientcmd.Factory, c *cobra.
 	config.KubeClient = kclient
 	dockerClient, _ := getDockerClient()
 
-	imageClient, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	imageClient, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
-	templateClient, err := f.OpenshiftInternalTemplateClient()
+	templateClient, err := templateclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
-	routeClient, err := f.OpenshiftInternalRouteClient()
+	routeClient, err := routeclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/process.go b/pkg/oc/cli/cmd/process.go
index 0ba1b2d07064..8b3a030dc5b0 100644
--- a/pkg/oc/cli/cmd/process.go
+++ b/pkg/oc/cli/cmd/process.go
@@ -32,6 +32,7 @@ import (
 	templateapi "github.com/openshift/origin/pkg/template/apis/template"
 	templatevalidation "github.com/openshift/origin/pkg/template/apis/template/validation"
 	templateinternalclient "github.com/openshift/origin/pkg/template/client/internalversion"
+	templateclientinternal "github.com/openshift/origin/pkg/template/generated/internalclientset"
 	templateclient "github.com/openshift/origin/pkg/template/generated/internalclientset/typed/template/internalversion"
 	"github.com/openshift/origin/pkg/template/generator"
 )
@@ -182,7 +183,11 @@ func RunProcess(f *clientcmd.Factory, in io.Reader, out, errout io.Writer, cmd *
 		mapper = legacyscheme.Registry.RESTMapper()
 		// client is deliberately left nil
 	} else {
-		templateClient, err := f.OpenshiftInternalTemplateClient()
+		clientConfig, err := f.ClientConfig()
+		if err != nil {
+			return err
+		}
+		templateClient, err := templateclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return err
 		}
diff --git a/pkg/oc/cli/cmd/project.go b/pkg/oc/cli/cmd/project.go
index 109598e6d5f2..75e52f0fc327 100644
--- a/pkg/oc/cli/cmd/project.go
+++ b/pkg/oc/cli/cmd/project.go
@@ -21,6 +21,7 @@ import (
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	projectapi "github.com/openshift/origin/pkg/project/apis/project"
 	projectapihelpers "github.com/openshift/origin/pkg/project/apis/project/helpers"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
 	projectclient "github.com/openshift/origin/pkg/project/generated/internalclientset/typed/project/internalversion"
 	projectutil "github.com/openshift/origin/pkg/project/util"
 
@@ -138,7 +139,7 @@ func (o *ProjectOptions) Complete(f *clientcmd.Factory, args []string, out io.Wr
 		if err != nil {
 			return nil, nil, err
 		}
-		projectClient, err := f.OpenshiftInternalProjectClient()
+		projectClient, err := projectclientinternal.NewForConfig(o.ClientConfig)
 		if err != nil {
 			return nil, nil, err
 		}
diff --git a/pkg/oc/cli/cmd/projects.go b/pkg/oc/cli/cmd/projects.go
index 0dcfb75bd5be..438962adee4f 100644
--- a/pkg/oc/cli/cmd/projects.go
+++ b/pkg/oc/cli/cmd/projects.go
@@ -19,6 +19,7 @@ import (
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	projectapi "github.com/openshift/origin/pkg/project/apis/project"
 	projectapihelpers "github.com/openshift/origin/pkg/project/apis/project/helpers"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
 	projectclient "github.com/openshift/origin/pkg/project/generated/internalclientset/typed/project/internalversion"
 
 	"github.com/spf13/cobra"
@@ -106,7 +107,7 @@ func (o *ProjectsOptions) Complete(f *clientcmd.Factory, args []string, commandN
 	if err != nil {
 		return err
 	}
-	projectClient, err := f.OpenshiftInternalProjectClient()
+	projectClient, err := projectclientinternal.NewForConfig(o.ClientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/request_project.go b/pkg/oc/cli/cmd/request_project.go
index 84312e648e2b..f36398928d2f 100644
--- a/pkg/oc/cli/cmd/request_project.go
+++ b/pkg/oc/cli/cmd/request_project.go
@@ -14,6 +14,7 @@ import (
 	cliconfig "github.com/openshift/origin/pkg/oc/cli/config"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	projectapi "github.com/openshift/origin/pkg/project/apis/project"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
 	projectclient "github.com/openshift/origin/pkg/project/generated/internalclientset/typed/project/internalversion"
 )
 
@@ -85,7 +86,9 @@ func NewCmdRequestProject(name, baseName string, f *clientcmd.Factory, out, erro
 		Example: fmt.Sprintf(requestProjectExample, baseName, name),
 		Run: func(cmd *cobra.Command, args []string) {
 			kcmdutil.CheckErr(o.Complete(f, cmd, args))
-			projectClient, err := f.OpenshiftInternalProjectClient()
+			clientConfig, err := f.ClientConfig()
+			kcmdutil.CheckErr(err)
+			projectClient, err := projectclientinternal.NewForConfig(clientConfig)
 			kcmdutil.CheckErr(err)
 			o.Client = projectClient.Project()
 			kcmdutil.CheckErr(o.Run())
diff --git a/pkg/oc/cli/cmd/rollback.go b/pkg/oc/cli/cmd/rollback.go
index 198a5ac1c44d..b8d6da042901 100644
--- a/pkg/oc/cli/cmd/rollback.go
+++ b/pkg/oc/cli/cmd/rollback.go
@@ -19,6 +19,7 @@ import (
 	kprinters "k8s.io/kubernetes/pkg/printers"
 
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	appsinternalversion "github.com/openshift/origin/pkg/apps/generated/internalclientset/typed/apps/internalversion"
 	appsutil "github.com/openshift/origin/pkg/apps/util"
 	describe "github.com/openshift/origin/pkg/oc/cli/describe"
@@ -146,7 +147,11 @@ func (o *RollbackOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, arg
 	if err != nil {
 		return err
 	}
-	appsClient, err := f.OpenshiftInternalAppsClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	appsClient, err := appsclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/rollout/latest.go b/pkg/oc/cli/cmd/rollout/latest.go
index 668b9a1c4ae1..b3dcaea586b1 100644
--- a/pkg/oc/cli/cmd/rollout/latest.go
+++ b/pkg/oc/cli/cmd/rollout/latest.go
@@ -105,11 +105,15 @@ func (o *RolloutLatestOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command
 	if err != nil {
 		return err
 	}
-	appsClient, err := f.OpenshiftInternalAppsClient()
+	clientConfig, err := f.ClientConfig()
 	if err != nil {
 		return err
 	}
-	o.appsClient = appsClient.Apps()
+	appsClient, err := appsclientinternal.NewForConfig(clientConfig)
+	if err != nil {
+		return err
+	}
+	o.appsClient = appsClient
 
 	o.mapper, o.typer = f.Object()
 	o.infos, err = f.NewBuilder().
diff --git a/pkg/oc/cli/cmd/startbuild.go b/pkg/oc/cli/cmd/startbuild.go
index b9756ebc3b28..eb24616fb370 100644
--- a/pkg/oc/cli/cmd/startbuild.go
+++ b/pkg/oc/cli/cmd/startbuild.go
@@ -36,7 +36,8 @@ import (
 
 	buildapiv1 "github.com/openshift/api/build/v1"
 	buildapi "github.com/openshift/origin/pkg/build/apis/build"
-	buildclientinternal "github.com/openshift/origin/pkg/build/client/internalversion"
+	buildclientinternalmanual "github.com/openshift/origin/pkg/build/client/internalversion"
+	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
 	buildclient "github.com/openshift/origin/pkg/build/generated/internalclientset/typed/build/internalversion"
 	cmdutil "github.com/openshift/origin/pkg/cmd/util"
 	"github.com/openshift/origin/pkg/git"
@@ -238,7 +239,11 @@ func (o *StartBuildOptions) Complete(f *clientcmd.Factory, in io.Reader, out, er
 		return err
 	}
 
-	c, err := f.OpenshiftInternalBuildClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	c, err := buildclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
@@ -374,7 +379,7 @@ func (o *StartBuildOptions) Run() error {
 		if len(o.BuildArgs) > 0 {
 			fmt.Fprintf(o.ErrOut, "WARNING: Specifying build arguments with binary builds is not supported.\n")
 		}
-		instantiateClient := buildclientinternal.NewBuildInstantiateBinaryClient(o.BuildClient.RESTClient(), o.Namespace)
+		instantiateClient := buildclientinternalmanual.NewBuildInstantiateBinaryClient(o.BuildClient.RESTClient(), o.Namespace)
 		if newBuild, err = streamPathToBuild(o.Git, o.In, o.ErrOut, instantiateClient, o.FromDir, o.FromFile, o.FromRepo, request); err != nil {
 			if kerrors.IsAlreadyExists(err) {
 				return transformIsAlreadyExistsError(err, o.Name)
@@ -411,7 +416,7 @@ func (o *StartBuildOptions) Run() error {
 			Follow: true,
 			NoWait: false,
 		}
-		logClient := buildclientinternal.NewBuildLogClient(o.BuildClient.RESTClient(), o.Namespace)
+		logClient := buildclientinternalmanual.NewBuildLogClient(o.BuildClient.RESTClient(), o.Namespace)
 		for {
 			rd, err := logClient.Logs(newBuild.Name, opts).Stream()
 			if err != nil {
@@ -459,7 +464,7 @@ func (o *StartBuildOptions) RunListBuildWebHooks() error {
 		return err
 	}
 
-	webhookClient := buildclientinternal.NewWebhookURLClient(o.BuildClient.RESTClient(), o.Namespace)
+	webhookClient := buildclientinternalmanual.NewWebhookURLClient(o.BuildClient.RESTClient(), o.Namespace)
 	for _, t := range config.Spec.Triggers {
 		hookType := ""
 		switch {
@@ -476,7 +481,7 @@ func (o *StartBuildOptions) RunListBuildWebHooks() error {
 		}
 		u, err := webhookClient.WebHookURL(o.Name, &t)
 		if err != nil {
-			if err != buildclientinternal.ErrTriggerIsNotAWebHook {
+			if err != buildclientinternalmanual.ErrTriggerIsNotAWebHook {
 				fmt.Fprintf(o.ErrOut, "error: unable to get webhook for %s: %v", o.Name, err)
 			}
 			continue
@@ -487,7 +492,7 @@ func (o *StartBuildOptions) RunListBuildWebHooks() error {
 	return nil
 }
 
-func streamPathToBuild(repo git.Repository, in io.Reader, out io.Writer, client buildclientinternal.BuildInstantiateBinaryInterface, fromDir, fromFile, fromRepo string, options *buildapi.BinaryBuildRequestOptions) (*buildapi.Build, error) {
+func streamPathToBuild(repo git.Repository, in io.Reader, out io.Writer, client buildclientinternalmanual.BuildInstantiateBinaryInterface, fromDir, fromFile, fromRepo string, options *buildapi.BinaryBuildRequestOptions) (*buildapi.Build, error) {
 	asDir, asFile, asRepo := len(fromDir) > 0, len(fromFile) > 0, len(fromRepo) > 0
 
 	if asRepo && !git.IsGitInstalled() {
diff --git a/pkg/oc/cli/cmd/status.go b/pkg/oc/cli/cmd/status.go
index b68e637e74ba..1e676562d6a4 100644
--- a/pkg/oc/cli/cmd/status.go
+++ b/pkg/oc/cli/cmd/status.go
@@ -12,9 +12,14 @@ import (
 	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
+	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	loginutil "github.com/openshift/origin/pkg/oc/cli/cmd/login/util"
 	"github.com/openshift/origin/pkg/oc/cli/describe"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
+	routeclientinternal "github.com/openshift/origin/pkg/route/generated/internalclientset"
 	dotutil "github.com/openshift/origin/pkg/util/dot"
 )
 
@@ -105,32 +110,31 @@ func (o *StatusOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, baseC
 	o.securityPolicyCommandFormat = "oc adm policy add-scc-to-user anyuid -n %s -z %s"
 	o.setProbeCommandName = fmt.Sprintf("%s set probe", cmd.Parent().CommandPath())
 
-	kclientset, err := f.ClientSet()
+	clientConfig, err := f.ClientConfig()
 	if err != nil {
 		return err
 	}
-	projectClient, err := f.OpenshiftInternalProjectClient()
+	kclientset, err := f.ClientSet()
 	if err != nil {
 		return err
 	}
-	buildClient, err := f.OpenshiftInternalBuildClient()
+	projectClient, err := projectclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
-	imageClient, err := f.OpenshiftInternalImageClient()
+	buildClient, err := buildclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
-	appsClient, err := f.OpenshiftInternalAppsClient()
+	imageClient, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
-	routeClient, err := f.OpenshiftInternalRouteClient()
+	appsClient, err := appsclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
-
-	config, err := f.ClientConfig()
+	routeClient, err := routeclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
@@ -160,7 +164,7 @@ func (o *StatusOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, baseC
 	}
 
 	nsFlag := kcmdutil.GetFlagString(cmd, "namespace")
-	canRequestProjects, _ := loginutil.CanRequestProjects(config, o.namespace)
+	canRequestProjects, _ := loginutil.CanRequestProjects(clientConfig, o.namespace)
 
 	o.describer = &describe.ProjectStatusDescriber{
 		KubeClient:    kclientset,
@@ -170,7 +174,7 @@ func (o *StatusOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, baseC
 		AppsClient:    appsClient.Apps(),
 		RouteClient:   routeClient.Route(),
 		Suggest:       o.suggest,
-		Server:        config.Host,
+		Server:        clientConfig.Host,
 
 		CommandBaseName:    baseCLIName,
 		RequestedNamespace: nsFlag,
diff --git a/pkg/oc/cli/cmd/tag.go b/pkg/oc/cli/cmd/tag.go
index 181fb0d81d0a..44e6cac9fa5f 100644
--- a/pkg/oc/cli/cmd/tag.go
+++ b/pkg/oc/cli/cmd/tag.go
@@ -19,6 +19,7 @@ import (
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imageclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 )
@@ -158,7 +159,11 @@ func (o *TagOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, args []s
 	o.out = out
 
 	// Setup clients.
-	client, err := f.OpenshiftInternalImageClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := imageclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/cmd/whoami.go b/pkg/oc/cli/cmd/whoami.go
index ef8aaa19ed64..ea6df10879db 100644
--- a/pkg/oc/cli/cmd/whoami.go
+++ b/pkg/oc/cli/cmd/whoami.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	userapi "github.com/openshift/origin/pkg/user/apis/user"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	userclient "github.com/openshift/origin/pkg/user/generated/internalclientset/typed/user/internalversion"
 )
 
@@ -91,7 +92,11 @@ func RunWhoAmI(f *clientcmd.Factory, out io.Writer, cmd *cobra.Command, args []s
 		return nil
 	}
 
-	client, err := f.OpenshiftInternalUserClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	client, err := userclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/cli/groupification.go b/pkg/oc/cli/groupification.go
new file mode 100644
index 000000000000..58f13b040d72
--- /dev/null
+++ b/pkg/oc/cli/groupification.go
@@ -0,0 +1,190 @@
+package cli
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	appsv1 "github.com/openshift/api/apps/v1"
+	authorizationv1 "github.com/openshift/api/authorization/v1"
+	buildv1 "github.com/openshift/api/build/v1"
+	imagev1 "github.com/openshift/api/image/v1"
+	networkv1 "github.com/openshift/api/network/v1"
+	oauthv1 "github.com/openshift/api/oauth/v1"
+	projectv1 "github.com/openshift/api/project/v1"
+	quotav1 "github.com/openshift/api/quota/v1"
+	routev1 "github.com/openshift/api/route/v1"
+	securityv1 "github.com/openshift/api/security/v1"
+	templatev1 "github.com/openshift/api/template/v1"
+	userv1 "github.com/openshift/api/user/v1"
+	"github.com/openshift/origin/pkg/apps/apis/apps"
+	"github.com/openshift/origin/pkg/authorization/apis/authorization"
+	"github.com/openshift/origin/pkg/build/apis/build"
+	"github.com/openshift/origin/pkg/image/apis/image"
+	"github.com/openshift/origin/pkg/network/apis/network"
+	"github.com/openshift/origin/pkg/oauth/apis/oauth"
+	"github.com/openshift/origin/pkg/project/apis/project"
+	"github.com/openshift/origin/pkg/quota/apis/quota"
+	"github.com/openshift/origin/pkg/route/apis/route"
+	"github.com/openshift/origin/pkg/security/apis/security"
+	"github.com/openshift/origin/pkg/template/apis/template"
+	"github.com/openshift/origin/pkg/user/apis/user"
+)
+
+func OAPIToGroupifiedGVK(gvk *schema.GroupVersionKind) {
+	if len(gvk.Group) > 0 {
+		return
+	}
+
+	newGroup, ok := oapiKindsToGroup[gvk.Kind]
+	if !ok {
+		return
+	}
+	gvk.Group = newGroup
+}
+
+func OAPIToGroupified(uncast runtime.Object, gvk *schema.GroupVersionKind) {
+	if len(gvk.Group) > 0 {
+		return
+	}
+
+	switch obj := uncast.(type) {
+	case *unstructured.Unstructured:
+		newGroup := fixOAPIGroupKindInTopLevelUnstructured(obj.Object)
+		if len(newGroup) > 0 {
+			gvk.Group = newGroup
+		}
+	case *unstructured.UnstructuredList:
+		newGroup := fixOAPIGroupKindInTopLevelUnstructured(obj.Object)
+		if len(newGroup) > 0 {
+			gvk.Group = newGroup
+		}
+
+	case *apps.DeploymentConfig, *appsv1.DeploymentConfig, *apps.DeploymentConfigList, *appsv1.DeploymentConfigList,
+		*apps.DeploymentConfigRollback, *appsv1.DeploymentConfigRollback:
+		gvk.Group = apps.GroupName
+
+	case *authorization.ClusterRoleBinding, *authorizationv1.ClusterRoleBinding, *authorization.ClusterRoleBindingList, *authorizationv1.ClusterRoleBindingList,
+		*authorization.ClusterRole, *authorizationv1.ClusterRole, *authorization.ClusterRoleList, *authorizationv1.ClusterRoleList,
+		*authorization.Role, *authorizationv1.Role, *authorization.RoleList, *authorizationv1.RoleList,
+		*authorization.RoleBinding, *authorizationv1.RoleBinding, *authorization.RoleBindingList, *authorizationv1.RoleBindingList,
+		*authorization.RoleBindingRestriction, *authorizationv1.RoleBindingRestriction, *authorization.RoleBindingRestrictionList, *authorizationv1.RoleBindingRestrictionList:
+		gvk.Group = authorization.GroupName
+
+	case *build.BuildConfig, *buildv1.BuildConfig, *build.BuildConfigList, *buildv1.BuildConfigList,
+		*build.Build, *buildv1.Build, *build.BuildList, *buildv1.BuildList:
+		gvk.Group = build.GroupName
+
+	case *image.Image, *imagev1.Image, *image.ImageList, *imagev1.ImageList,
+		*image.ImageSignature, *imagev1.ImageSignature,
+		*image.ImageStreamImage, *imagev1.ImageStreamImage,
+		*image.ImageStreamImport, *imagev1.ImageStreamImport,
+		*image.ImageStreamMapping, *imagev1.ImageStreamMapping,
+		*image.ImageStream, *imagev1.ImageStream, *image.ImageStreamList, *imagev1.ImageStreamList,
+		*image.ImageStreamTag, *imagev1.ImageStreamTag:
+		gvk.Group = image.GroupName
+
+	case *network.ClusterNetwork, *networkv1.ClusterNetwork, *network.ClusterNetworkList, *networkv1.ClusterNetworkList,
+		*network.NetNamespace, *networkv1.NetNamespace, *network.NetNamespaceList, *networkv1.NetNamespaceList,
+		*network.HostSubnet, *networkv1.HostSubnet, *network.HostSubnetList, *networkv1.HostSubnetList,
+		*network.EgressNetworkPolicy, *networkv1.EgressNetworkPolicy, *network.EgressNetworkPolicyList, *networkv1.EgressNetworkPolicyList:
+		gvk.Group = network.GroupName
+
+	case *project.Project, *projectv1.Project, *project.ProjectList, *projectv1.ProjectList,
+		*project.ProjectRequest, *projectv1.ProjectRequest:
+		gvk.Group = project.GroupName
+
+	case *quota.ClusterResourceQuota, *quotav1.ClusterResourceQuota, *quota.ClusterResourceQuotaList, *quotav1.ClusterResourceQuotaList:
+		gvk.Group = quota.GroupName
+
+	case *oauth.OAuthAuthorizeToken, *oauthv1.OAuthAuthorizeToken, *oauth.OAuthAuthorizeTokenList, *oauthv1.OAuthAuthorizeTokenList,
+		*oauth.OAuthClientAuthorization, *oauthv1.OAuthClientAuthorization, *oauth.OAuthClientAuthorizationList, *oauthv1.OAuthClientAuthorizationList,
+		*oauth.OAuthClient, *oauthv1.OAuthClient, *oauth.OAuthClientList, *oauthv1.OAuthClientList,
+		*oauth.OAuthAccessToken, *oauthv1.OAuthAccessToken, *oauth.OAuthAccessTokenList, *oauthv1.OAuthAccessTokenList:
+		gvk.Group = oauth.GroupName
+
+	case *route.Route, *routev1.Route, *route.RouteList, *routev1.RouteList:
+		gvk.Group = route.GroupName
+
+	case *security.SecurityContextConstraints, *securityv1.SecurityContextConstraints, *security.SecurityContextConstraintsList, *securityv1.SecurityContextConstraintsList:
+		gvk.Group = security.GroupName
+
+	case *template.Template, *templatev1.Template, *template.TemplateList, *templatev1.TemplateList:
+		gvk.Group = template.GroupName
+
+	case *user.Group, *userv1.Group, *user.GroupList, *userv1.GroupList,
+		*user.Identity, *userv1.Identity, *user.IdentityList, *userv1.IdentityList,
+		*user.UserIdentityMapping, *userv1.UserIdentityMapping,
+		*user.User, *userv1.User, *user.UserList, *userv1.UserList:
+		gvk.Group = user.GroupName
+
+	}
+}
+
+var oapiKindsToGroup = map[string]string{
+	"DeploymentConfigRollback": "apps.openshift.io",
+	"DeploymentConfig":         "apps.openshift.io", "DeploymentConfigList": "apps.openshift.io",
+	"ClusterRoleBinding": "authorization.openshift.io", "ClusterRoleBindingList": "authorization.openshift.io",
+	"ClusterRole": "authorization.openshift.io", "ClusterRoleList": "authorization.openshift.io",
+	"RoleBindingRestriction": "authorization.openshift.io", "RoleBindingRestrictionList": "authorization.openshift.io",
+	"RoleBinding": "authorization.openshift.io", "RoleBindingList": "authorization.openshift.io",
+	"Role": "authorization.openshift.io", "RoleList": "authorization.openshift.io",
+	"BuildConfig": "build.openshift.io", "BuildConfigList": "build.openshift.io",
+	"Build": "build.openshift.io", "BuildList": "build.openshift.io",
+	"Image": "image.openshift.io", "ImageList": "image.openshift.io",
+	"ImageSignature":     "image.openshift.io",
+	"ImageStreamImage":   "image.openshift.io",
+	"ImageStreamImport":  "image.openshift.io",
+	"ImageStreamMapping": "image.openshift.io",
+	"ImageStream":        "image.openshift.io", "ImageStreamList": "image.openshift.io",
+	"ImageStreamTag": "image.openshift.io", "ImageStreamTagList": "image.openshift.io",
+	"ClusterNetwork": "network.openshift.io", "ClusterNetworkList": "network.openshift.io",
+	"EgressNetworkPolicy": "network.openshift.io", "EgressNetworkPolicyList": "network.openshift.io",
+	"HostSubnet": "network.openshift.io", "HostSubnetList": "network.openshift.io",
+	"NetNamespace": "network.openshift.io", "NetNamespaceList": "network.openshift.io",
+	"OAuthAccessToken": "oauth.openshift.io", "OAuthAccessTokenList": "oauth.openshift.io",
+	"OAuthAuthorizeToken": "oauth.openshift.io", "OAuthAuthorizeTokenList": "oauth.openshift.io",
+	"OAuthClientAuthorization": "oauth.openshift.io", "OAuthClientAuthorizationList": "oauth.openshift.io",
+	"OAuthClient": "oauth.openshift.io", "OAuthClientList": "oauth.openshift.io",
+	"Project": "project.openshift.io", "ProjectList": "project.openshift.io",
+	"ProjectRequest":       "project.openshift.io",
+	"ClusterResourceQuota": "quota.openshift.io", "ClusterResourceQuotaList": "quota.openshift.io",
+	"Route": "route.openshift.io", "RouteList": "route.openshift.io",
+	"SecurityContextConstraint": "security.openshift.io", "SecurityContextConstraintList": "security.openshift.io",
+	"Template": "template.openshift.io", "TemplateList": "template.openshift.io",
+	"Group": "user.openshift.io", "GroupList": "user.openshift.io",
+	"Identity": "user.openshift.io", "IdentityList": "user.openshift.io",
+	"UserIdentityMapping": "user.openshift.io",
+	"User":                "user.openshift.io", "UserList": "user.openshift.io",
+}
+
+func fixOAPIGroupKindInTopLevelUnstructured(obj map[string]interface{}) string {
+	kind, ok := obj["kind"]
+	if !ok {
+		return ""
+	}
+	kindStr, ok := kind.(string)
+	if !ok {
+		return ""
+	}
+	newGroup, ok := oapiKindsToGroup[kindStr]
+	if !ok {
+		return ""
+	}
+
+	apiVersion, ok := obj["apiVersion"]
+	if !ok {
+		return newGroup
+	}
+	apiVersionStr, ok := apiVersion.(string)
+	if !ok {
+		return newGroup
+	}
+
+	if apiVersionStr != "v1" {
+		return newGroup
+	}
+	obj["apiVersion"] = newGroup + "/v1"
+
+	return newGroup
+}
diff --git a/pkg/oc/cli/util/clientcmd/client.go b/pkg/oc/cli/util/clientcmd/client.go
deleted file mode 100644
index d020f249e6d5..000000000000
--- a/pkg/oc/cli/util/clientcmd/client.go
+++ /dev/null
@@ -1,193 +0,0 @@
-package clientcmd
-
-import (
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-
-	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
-	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
-	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
-	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
-	networkclientinternal "github.com/openshift/origin/pkg/network/generated/internalclientset"
-	oauthclientinternal "github.com/openshift/origin/pkg/oauth/generated/internalclientset"
-	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
-	quotaclientinternal "github.com/openshift/origin/pkg/quota/generated/internalclientset"
-	routeclientinternal "github.com/openshift/origin/pkg/route/generated/internalclientset"
-	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
-	templateclientinternal "github.com/openshift/origin/pkg/template/generated/internalclientset"
-	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
-)
-
-// CLIClientBuilder provides clients for the CLI.
-type CLIClientBuilder interface {
-	OpenshiftInternalTemplateClient() (templateclientinternal.Interface, error)
-	OpenshiftInternalImageClient() (imageclientinternal.Interface, error)
-	OpenshiftInternalAppsClient() (appsclientinternal.Interface, error)
-	OpenshiftInternalBuildClient() (buildclientinternal.Interface, error)
-	OpenshiftInternalAuthorizationClient() (authorizationclientinternal.Interface, error)
-	OpenshiftInternalNetworkClient() (networkclientinternal.Interface, error)
-	OpenshiftInternalOAuthClient() (oauthclientinternal.Interface, error)
-	OpenshiftInternalProjectClient() (projectclientinternal.Interface, error)
-	OpenshiftInternalQuotaClient() (quotaclientinternal.Interface, error)
-	OpenshiftInternalRouteClient() (routeclientinternal.Interface, error)
-	OpenshiftInternalSecurityClient() (securityclientinternal.Interface, error)
-	OpenshiftInternalUserClient() (userclientinternal.Interface, error)
-
-	Config() (*rest.Config, error)
-}
-
-// OpenshiftCLIClientBuilder implements the CLIClientBuilder.
-type OpenshiftCLIClientBuilder struct {
-	config clientcmd.ClientConfig
-}
-
-func (b *OpenshiftCLIClientBuilder) Config() (*rest.Config, error) {
-	return b.config.ClientConfig()
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalAppsClient() (appsclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := appsclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalAuthorizationClient() (authorizationclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	// used for reconcile commands touching dozens of objects
-	clientConfig.QPS = 50
-	clientConfig.Burst = 100
-	client, err := authorizationclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalBuildClient() (buildclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := buildclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalImageClient() (imageclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := imageclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalNetworkClient() (networkclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := networkclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalOAuthClient() (oauthclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := oauthclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalProjectClient() (projectclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := projectclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalQuotaClient() (quotaclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := quotaclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalRouteClient() (routeclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := routeclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalSecurityClient() (securityclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := securityclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalTemplateClient() (templateclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := templateclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (b *OpenshiftCLIClientBuilder) OpenshiftInternalUserClient() (userclientinternal.Interface, error) {
-	clientConfig, err := b.Config()
-	if err != nil {
-		return nil, err
-	}
-	client, err := userclientinternal.NewForConfig(clientConfig)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
diff --git a/pkg/oc/cli/util/clientcmd/factory.go b/pkg/oc/cli/util/clientcmd/factory.go
index 4832f0b29cd0..1016ad9fb3d2 100644
--- a/pkg/oc/cli/util/clientcmd/factory.go
+++ b/pkg/oc/cli/util/clientcmd/factory.go
@@ -30,6 +30,7 @@ import (
 	"k8s.io/kubernetes/pkg/kubectl/resource"
 
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	appsutil "github.com/openshift/origin/pkg/apps/util"
 	buildapi "github.com/openshift/origin/pkg/build/apis/build"
 	"github.com/openshift/origin/pkg/cmd/util"
@@ -47,7 +48,7 @@ func New(flags *pflag.FlagSet) *Factory {
 
 // Factory provides common options for OpenShift commands
 type Factory struct {
-	ClientAccessFactory
+	kcmdutil.ClientAccessFactory
 	kcmdutil.ObjectMappingFactory
 	kcmdutil.BuilderFactory
 }
@@ -317,6 +318,10 @@ func (f *Factory) PodForResource(resource string, timeout time.Duration) (string
 	if err != nil {
 		return "", err
 	}
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return "", err
+	}
 
 	switch resourceType {
 	case api.Resource("pods"):
@@ -337,7 +342,7 @@ func (f *Factory) PodForResource(resource string, timeout time.Duration) (string
 		}
 		return pod.Name, nil
 	case appsapi.Resource("deploymentconfigs"), appsapi.LegacyResource("deploymentconfigs"):
-		appsClient, err := f.OpenshiftInternalAppsClient()
+		appsClient, err := appsclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return "", err
 		}
diff --git a/pkg/oc/cli/util/clientcmd/factory_builder.go b/pkg/oc/cli/util/clientcmd/factory_builder.go
index 0cb892ab15f0..013b1b884c56 100644
--- a/pkg/oc/cli/util/clientcmd/factory_builder.go
+++ b/pkg/oc/cli/util/clientcmd/factory_builder.go
@@ -11,22 +11,26 @@ import (
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
 	appsclient "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
+	authorizationclientinternal "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
 	authorizationreaper "github.com/openshift/origin/pkg/authorization/reaper"
 	buildapi "github.com/openshift/origin/pkg/build/apis/build"
-	buildclient "github.com/openshift/origin/pkg/build/generated/internalclientset"
+	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
+	oauthclientinternal "github.com/openshift/origin/pkg/oauth/generated/internalclientset"
 	buildcmd "github.com/openshift/origin/pkg/oc/cli/builds"
 	deploymentcmd "github.com/openshift/origin/pkg/oc/cli/deploymentconfigs"
+	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
 	userapi "github.com/openshift/origin/pkg/user/apis/user"
+	userclientinternal "github.com/openshift/origin/pkg/user/generated/internalclientset"
 	authenticationreaper "github.com/openshift/origin/pkg/user/reaper"
 )
 
 type ring2Factory struct {
-	clientAccessFactory  ClientAccessFactory
+	clientAccessFactory  kcmdutil.ClientAccessFactory
 	objectMappingFactory kcmdutil.ObjectMappingFactory
 	kubeBuilderFactory   kcmdutil.BuilderFactory
 }
 
-func NewBuilderFactory(clientAccessFactory ClientAccessFactory, objectMappingFactory kcmdutil.ObjectMappingFactory) kcmdutil.BuilderFactory {
+func NewBuilderFactory(clientAccessFactory kcmdutil.ClientAccessFactory, objectMappingFactory kcmdutil.ObjectMappingFactory) kcmdutil.BuilderFactory {
 	return &ring2Factory{
 		clientAccessFactory:  clientAccessFactory,
 		objectMappingFactory: objectMappingFactory,
@@ -61,6 +65,11 @@ func (f *ring2Factory) Scaler() (kubectl.Scaler, error) {
 }
 
 func (f *ring2Factory) Reaper(mapping *meta.RESTMapping) (kubectl.Reaper, error) {
+	clientConfig, err := f.clientAccessFactory.ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	gk := mapping.GroupVersionKind.GroupKind()
 	switch {
 	case appsapi.IsKindOrLegacy("DeploymentConfig", gk):
@@ -78,31 +87,31 @@ func (f *ring2Factory) Reaper(mapping *meta.RESTMapping) (kubectl.Reaper, error)
 		}
 		return deploymentcmd.NewDeploymentConfigReaper(appsclient.NewForConfigOrDie(config), kc, scaleClient), nil
 	case authorizationapi.IsKindOrLegacy("Role", gk):
-		authClient, err := f.clientAccessFactory.OpenshiftInternalAuthorizationClient()
+		authClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
 		return authorizationreaper.NewRoleReaper(authClient.Authorization(), authClient.Authorization()), nil
 	case authorizationapi.IsKindOrLegacy("ClusterRole", gk):
-		authClient, err := f.clientAccessFactory.OpenshiftInternalAuthorizationClient()
+		authClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
 		return authorizationreaper.NewClusterRoleReaper(authClient.Authorization(), authClient.Authorization(), authClient.Authorization()), nil
 	case userapi.IsKindOrLegacy("User", gk):
-		userClient, err := f.clientAccessFactory.OpenshiftInternalUserClient()
+		userClient, err := userclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
-		authClient, err := f.clientAccessFactory.OpenshiftInternalAuthorizationClient()
+		authClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
-		oauthClient, err := f.clientAccessFactory.OpenshiftInternalOAuthClient()
+		oauthClient, err := oauthclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
-		securityClient, err := f.clientAccessFactory.OpenshiftInternalSecurityClient()
+		securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
@@ -115,15 +124,15 @@ func (f *ring2Factory) Reaper(mapping *meta.RESTMapping) (kubectl.Reaper, error)
 			securityClient.Security().SecurityContextConstraints(),
 		), nil
 	case userapi.IsKindOrLegacy("Group", gk):
-		userClient, err := f.clientAccessFactory.OpenshiftInternalUserClient()
+		userClient, err := userclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
-		authClient, err := f.clientAccessFactory.OpenshiftInternalAuthorizationClient()
+		authClient, err := authorizationclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
-		securityClient, err := f.clientAccessFactory.OpenshiftInternalSecurityClient()
+		securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
@@ -138,7 +147,7 @@ func (f *ring2Factory) Reaper(mapping *meta.RESTMapping) (kubectl.Reaper, error)
 		if err != nil {
 			return nil, err
 		}
-		return buildcmd.NewBuildConfigReaper(buildclient.NewForConfigOrDie(config)), nil
+		return buildcmd.NewBuildConfigReaper(buildclientinternal.NewForConfigOrDie(config)), nil
 	}
 	return f.kubeBuilderFactory.Reaper(mapping)
 }
diff --git a/pkg/oc/cli/util/clientcmd/factory_client_access.go b/pkg/oc/cli/util/clientcmd/factory_client_access.go
index 20bd798e9906..d60502283105 100644
--- a/pkg/oc/cli/util/clientcmd/factory_client_access.go
+++ b/pkg/oc/cli/util/clientcmd/factory_client_access.go
@@ -2,12 +2,10 @@ package clientcmd
 
 import (
 	"errors"
-	"net/http"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -21,14 +19,12 @@ import (
 	restclient "k8s.io/client-go/rest"
 	kclientcmd "k8s.io/client-go/tools/clientcmd"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
-	"k8s.io/client-go/util/homedir"
 	kapi "k8s.io/kubernetes/pkg/apis/core"
 	kclientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
 	"k8s.io/kubernetes/pkg/kubectl"
 	"k8s.io/kubernetes/pkg/kubectl/cmd/set"
 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 	"k8s.io/kubernetes/pkg/kubectl/resource"
-	"k8s.io/kubernetes/pkg/kubectl/util/transport"
 
 	appsapiv1 "github.com/openshift/api/apps/v1"
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
@@ -38,87 +34,22 @@ import (
 )
 
 type ring0Factory struct {
-	*OpenshiftCLIClientBuilder
-
-	clientConfig            kclientcmd.ClientConfig
 	kubeClientAccessFactory kcmdutil.ClientAccessFactory
 }
 
-type ClientAccessFactory interface {
-	kcmdutil.ClientAccessFactory
-	CLIClientBuilder
-}
-
-func NewClientAccessFactory(optionalClientConfig kclientcmd.ClientConfig) ClientAccessFactory {
+func NewClientAccessFactory(optionalClientConfig kclientcmd.ClientConfig) kcmdutil.ClientAccessFactory {
 	// if we call this factory construction method, we want the openshift style config loading
 	kclientcmd.UseOpenShiftKubeConfigValues = true
 	kclientcmd.ErrEmptyConfig = kclientcmd.NewErrConfigurationMissing()
 	set.ParseDockerImageReferenceToStringFunc = ParseDockerImageReferenceToStringFunc
 
-	flags := pflag.NewFlagSet("", pflag.ContinueOnError)
-	clientConfig := optionalClientConfig
-	if optionalClientConfig == nil {
-		clientConfig = kcmdutil.DefaultClientConfig(flags)
-	}
 	factory := &ring0Factory{
-		clientConfig: clientConfig,
+		kubeClientAccessFactory: kcmdutil.NewClientAccessFactory(optionalClientConfig),
 	}
-	factory.kubeClientAccessFactory = kcmdutil.NewClientAccessFactoryFromDiscovery(
-		flags,
-		clientConfig,
-		&discoveryFactory{clientConfig: clientConfig},
-	)
-	factory.OpenshiftCLIClientBuilder = &OpenshiftCLIClientBuilder{config: clientConfig}
 
 	return factory
 }
 
-type discoveryFactory struct {
-	clientConfig kclientcmd.ClientConfig
-	cacheDir     string
-}
-
-func (f *discoveryFactory) BindFlags(flags *pflag.FlagSet) {
-	defaultCacheDir := filepath.Join(homedir.HomeDir(), ".kube", "http-cache")
-	flags.StringVar(&f.cacheDir, kcmdutil.FlagHTTPCacheDir, defaultCacheDir, "Default HTTP cache directory")
-}
-
-func (f *discoveryFactory) DiscoveryClient() (discovery.CachedDiscoveryInterface, error) {
-	// Output using whatever version was negotiated in the client cache. The
-	// version we decode with may not be the same as what the server requires.
-	cfg, err := f.clientConfig.ClientConfig()
-	if err != nil {
-		return nil, err
-	}
-	// given 25 groups with one-ish version each, discovery needs to make 50 requests
-	// double it just so we don't end up here again for a while.  This config is only used for discovery.
-	cfg.Burst = 100
-
-	if f.cacheDir != "" {
-		wt := cfg.WrapTransport
-		cfg.WrapTransport = func(rt http.RoundTripper) http.RoundTripper {
-			if wt != nil {
-				rt = wt(rt)
-			}
-			return transport.NewCacheRoundTripper(f.cacheDir, rt)
-		}
-	}
-
-	// at this point we've negotiated and can get the client
-	kubeClient, err := kclientset.NewForConfig(cfg)
-	if err != nil {
-		return nil, err
-
-	}
-
-	cacheDir := computeDiscoverCacheDir(filepath.Join(homedir.HomeDir(), ".kube", "cache", "discovery"), cfg.Host)
-	return kcmdutil.NewCachedDiscoveryClient(newLegacyDiscoveryClient(kubeClient.Discovery().RESTClient()), cacheDir, time.Duration(10*time.Minute)), nil
-}
-
-func (f *ring0Factory) RawConfig() (clientcmdapi.Config, error) {
-	return f.kubeClientAccessFactory.RawConfig()
-}
-
 func (f *ring0Factory) DiscoveryClient() (discovery.CachedDiscoveryInterface, error) {
 	return f.kubeClientAccessFactory.DiscoveryClient()
 }
@@ -135,8 +66,12 @@ func (f *ring0Factory) ClientConfig() (*restclient.Config, error) {
 	return f.kubeClientAccessFactory.ClientConfig()
 }
 
+func (f *ring0Factory) RawConfig() (clientcmdapi.Config, error) {
+	return f.kubeClientAccessFactory.RawConfig()
+}
+
 func (f *ring0Factory) BareClientConfig() (*restclient.Config, error) {
-	return f.clientConfig.ClientConfig()
+	return f.kubeClientAccessFactory.BareClientConfig()
 }
 
 func (f *ring0Factory) RESTClient() (*restclient.RESTClient, error) {
diff --git a/pkg/oc/cli/util/clientcmd/factory_object_mapping.go b/pkg/oc/cli/util/clientcmd/factory_object_mapping.go
index e17029453b82..9990c4158fc1 100644
--- a/pkg/oc/cli/util/clientcmd/factory_object_mapping.go
+++ b/pkg/oc/cli/util/clientcmd/factory_object_mapping.go
@@ -11,7 +11,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/dynamic"
 	restclient "k8s.io/client-go/rest"
 	kapi "k8s.io/kubernetes/pkg/apis/core"
 	"k8s.io/kubernetes/pkg/controller"
@@ -27,22 +26,23 @@ import (
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
 	appsmanualclient "github.com/openshift/origin/pkg/apps/client/internalversion"
 	appsclient "github.com/openshift/origin/pkg/apps/generated/internalclientset"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	appsutil "github.com/openshift/origin/pkg/apps/util"
 	buildapi "github.com/openshift/origin/pkg/build/apis/build"
 	buildmanualclient "github.com/openshift/origin/pkg/build/client/internalversion"
+	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
 	buildutil "github.com/openshift/origin/pkg/build/util"
-	configcmd "github.com/openshift/origin/pkg/bulk"
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
 	deploymentcmd "github.com/openshift/origin/pkg/oc/cli/deploymentconfigs"
 	"github.com/openshift/origin/pkg/oc/cli/describe"
 )
 
 type ring1Factory struct {
-	clientAccessFactory      ClientAccessFactory
+	clientAccessFactory      kcmdutil.ClientAccessFactory
 	kubeObjectMappingFactory kcmdutil.ObjectMappingFactory
 }
 
-func NewObjectMappingFactory(clientAccessFactory ClientAccessFactory) kcmdutil.ObjectMappingFactory {
+func NewObjectMappingFactory(clientAccessFactory kcmdutil.ClientAccessFactory) kcmdutil.ObjectMappingFactory {
 	return &ring1Factory{
 		clientAccessFactory:      clientAccessFactory,
 		kubeObjectMappingFactory: kcmdutil.NewObjectMappingFactory(clientAccessFactory),
@@ -58,45 +58,10 @@ func (f *ring1Factory) CategoryExpander() categories.CategoryExpander {
 }
 
 func (f *ring1Factory) ClientForMapping(mapping *meta.RESTMapping) (resource.RESTClient, error) {
-	// TODO only do this for legacy kinds
-	if latest.OriginKind(mapping.GroupVersionKind) {
-		cfg, err := f.clientAccessFactory.ClientConfig()
-		if err != nil {
-			return nil, err
-		}
-		if err := configcmd.SetLegacyOpenShiftDefaults(cfg); err != nil {
-			return nil, err
-		}
-		cfg.APIPath = "/apis"
-		if mapping.GroupVersionKind.Group == kapi.GroupName {
-			cfg.APIPath = "/oapi"
-		}
-		gv := mapping.GroupVersionKind.GroupVersion()
-		cfg.GroupVersion = &gv
-		return restclient.RESTClientFor(cfg)
-	}
 	return f.kubeObjectMappingFactory.ClientForMapping(mapping)
 }
 
 func (f *ring1Factory) UnstructuredClientForMapping(mapping *meta.RESTMapping) (resource.RESTClient, error) {
-	// TODO only do this for legacy kinds
-	if latest.OriginKind(mapping.GroupVersionKind) {
-		cfg, err := f.clientAccessFactory.ClientConfig()
-		if err != nil {
-			return nil, err
-		}
-		if err := configcmd.SetLegacyOpenShiftDefaults(cfg); err != nil {
-			return nil, err
-		}
-		cfg.APIPath = "/apis"
-		if mapping.GroupVersionKind.Group == kapi.GroupName {
-			cfg.APIPath = "/oapi"
-		}
-		gv := mapping.GroupVersionKind.GroupVersion()
-		cfg.ContentConfig = dynamic.ContentConfig()
-		cfg.GroupVersion = &gv
-		return restclient.RESTClientFor(cfg)
-	}
 	return f.kubeObjectMappingFactory.UnstructuredClientForMapping(mapping)
 }
 
@@ -121,17 +86,23 @@ func (f *ring1Factory) Describer(mapping *meta.RESTMapping) (kprinters.Describer
 		}
 		return describer, nil
 	}
+
 	return f.kubeObjectMappingFactory.Describer(mapping)
 }
 
 func (f *ring1Factory) LogsForObject(object, options runtime.Object, timeout time.Duration) (*restclient.Request, error) {
+	clientConfig, err := f.clientAccessFactory.ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	switch t := object.(type) {
 	case *appsapi.DeploymentConfig:
 		dopts, ok := options.(*appsapi.DeploymentLogOptions)
 		if !ok {
 			return nil, errors.New("provided options object is not a DeploymentLogOptions")
 		}
-		appsClient, err := f.clientAccessFactory.OpenshiftInternalAppsClient()
+		appsClient, err := appsclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
@@ -144,7 +115,7 @@ func (f *ring1Factory) LogsForObject(object, options runtime.Object, timeout tim
 		if bopts.Version != nil {
 			return nil, errors.New("cannot specify a version and a build")
 		}
-		buildClient, err := f.clientAccessFactory.OpenshiftInternalBuildClient()
+		buildClient, err := buildclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
@@ -154,7 +125,7 @@ func (f *ring1Factory) LogsForObject(object, options runtime.Object, timeout tim
 		if !ok {
 			return nil, errors.New("provided options object is not a BuildLogOptions")
 		}
-		buildClient, err := f.clientAccessFactory.OpenshiftInternalBuildClient()
+		buildClient, err := buildclientinternal.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/oc/cli/util/clientcmd/legacy_discovery.go b/pkg/oc/cli/util/clientcmd/legacy_discovery.go
deleted file mode 100644
index cab093f560da..000000000000
--- a/pkg/oc/cli/util/clientcmd/legacy_discovery.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package clientcmd
-
-import (
-	"net/url"
-
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/client-go/discovery"
-	restclient "k8s.io/client-go/rest"
-)
-
-// legacyDiscoveryClient  implements the functions that discovery server-supported API groups,
-// versions and resources.
-type legacyDiscoveryClient struct {
-	*discovery.DiscoveryClient
-}
-
-// ServerResourcesForGroupVersion returns the supported resources for a group and version.
-// This can return an error *and* a partial result
-func (d *legacyDiscoveryClient) ServerResourcesForGroupVersion(groupVersion string) (resources *metav1.APIResourceList, err error) {
-	parentList, err := d.DiscoveryClient.ServerResourcesForGroupVersion(groupVersion)
-	if err != nil {
-		return parentList, err
-	}
-
-	if groupVersion != "v1" {
-		return parentList, nil
-	}
-
-	// we request v1, we must combine the parent list with the list from /oapi
-
-	url := url.URL{}
-	url.Path = "/oapi/" + groupVersion
-	originResources := &metav1.APIResourceList{}
-	err = d.RESTClient().Get().AbsPath(url.String()).Do().Into(originResources)
-	if err != nil {
-		// ignore 403 or 404 error to be compatible with an v1.0 server.
-		if groupVersion == "v1" && (errors.IsNotFound(err) || errors.IsForbidden(err)) {
-			return parentList, nil
-		}
-		return parentList, err
-	}
-
-	parentList.APIResources = append(parentList.APIResources, originResources.APIResources...)
-	return parentList, nil
-}
-
-// ServerResources returns the supported resources for all groups and versions.
-// This can return an error *and* a partial result
-func (d *legacyDiscoveryClient) ServerResources() ([]*metav1.APIResourceList, error) {
-	apiGroups, err := d.ServerGroups()
-	if err != nil {
-		return nil, err
-	}
-
-	result := []*metav1.APIResourceList{}
-	failedGroups := make(map[schema.GroupVersion]error)
-
-	for _, apiGroup := range apiGroups.Groups {
-		for _, version := range apiGroup.Versions {
-			gv := schema.GroupVersion{Group: apiGroup.Name, Version: version.Version}
-			resources, err := d.ServerResourcesForGroupVersion(version.GroupVersion)
-			if err != nil {
-				failedGroups[gv] = err
-				continue
-			}
-
-			result = append(result, resources)
-		}
-	}
-
-	if len(failedGroups) == 0 {
-		return result, nil
-	}
-
-	return result, &discovery.ErrGroupDiscoveryFailed{Groups: failedGroups}
-}
-
-// newLegacyDiscoveryClient creates a new DiscoveryClient for the given RESTClient.
-func newLegacyDiscoveryClient(c restclient.Interface) *legacyDiscoveryClient {
-	return &legacyDiscoveryClient{discovery.NewDiscoveryClient(c)}
-}
diff --git a/pkg/oc/experimental/buildchain/buildchain.go b/pkg/oc/experimental/buildchain/buildchain.go
index 021dd402c319..6cefb1f661b7 100644
--- a/pkg/oc/experimental/buildchain/buildchain.go
+++ b/pkg/oc/experimental/buildchain/buildchain.go
@@ -13,13 +13,16 @@ import (
 	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
 	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 
+	buildclientinternal "github.com/openshift/origin/pkg/build/generated/internalclientset"
 	buildclient "github.com/openshift/origin/pkg/build/generated/internalclientset/typed/build/internalversion"
 	osutil "github.com/openshift/origin/pkg/cmd/util"
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	imageclientinternal "github.com/openshift/origin/pkg/image/generated/internalclientset"
 	imageclient "github.com/openshift/origin/pkg/image/generated/internalclientset/typed/image/internalversion"
 	"github.com/openshift/origin/pkg/oc/cli/describe"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	imagegraph "github.com/openshift/origin/pkg/oc/graph/imagegraph/nodes"
+	projectclientinternal "github.com/openshift/origin/pkg/project/generated/internalclientset"
 	projectclient "github.com/openshift/origin/pkg/project/generated/internalclientset/typed/project/internalversion"
 )
 
@@ -92,15 +95,19 @@ func (o *BuildChainOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command, a
 		return cmdutil.UsageErrorf(cmd, "Must pass an image stream tag. If only an image stream name is specified, 'latest' will be used for the tag.")
 	}
 
-	buildClient, err := f.OpenshiftInternalBuildClient()
+	clientConfig, err := f.ClientConfig()
 	if err != nil {
 		return err
 	}
-	imageClient, err := f.OpenshiftInternalImageClient()
+	buildClient, err := buildclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
-	projectClient, err := f.OpenshiftInternalProjectClient()
+	imageClient, err := imageclientinternal.NewForConfig(clientConfig)
+	if err != nil {
+		return err
+	}
+	projectClient, err := projectclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/oc/experimental/ipfailover/ipfailover.go b/pkg/oc/experimental/ipfailover/ipfailover.go
index eb924b80d308..c0ae06332021 100644
--- a/pkg/oc/experimental/ipfailover/ipfailover.go
+++ b/pkg/oc/experimental/ipfailover/ipfailover.go
@@ -22,7 +22,7 @@ import (
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	"github.com/openshift/origin/pkg/oc/experimental/ipfailover/ipfailover"
 	"github.com/openshift/origin/pkg/oc/experimental/ipfailover/keepalived"
-	securityclient "github.com/openshift/origin/pkg/security/generated/internalclientset"
+	securityclientinternal "github.com/openshift/origin/pkg/security/generated/internalclientset"
 )
 
 var (
@@ -186,7 +186,11 @@ func Run(f *clientcmd.Factory, options *ipfailover.IPFailoverConfigCmdOptions, c
 	if err != nil {
 		return err
 	}
-	securityClient, err := f.OpenshiftInternalSecurityClient()
+	clientConfig, err := f.ClientConfig()
+	if err != nil {
+		return err
+	}
+	securityClient, err := securityclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return err
 	}
@@ -210,7 +214,7 @@ func Run(f *clientcmd.Factory, options *ipfailover.IPFailoverConfigCmdOptions, c
 	return nil
 }
 
-func validateServiceAccount(client securityclient.Interface, ns string, serviceAccount string) error {
+func validateServiceAccount(client securityclientinternal.Interface, ns string, serviceAccount string) error {
 	sccList, err := client.Security().SecurityContextConstraints().List(metav1.ListOptions{})
 	if err != nil {
 		if !errors.IsUnauthorized(err) {
diff --git a/pkg/oc/experimental/ipfailover/keepalived/plugin.go b/pkg/oc/experimental/ipfailover/keepalived/plugin.go
index c253e06f3cff..63655331579e 100644
--- a/pkg/oc/experimental/ipfailover/keepalived/plugin.go
+++ b/pkg/oc/experimental/ipfailover/keepalived/plugin.go
@@ -11,6 +11,7 @@ import (
 	kapi "k8s.io/kubernetes/pkg/apis/core"
 
 	appsapi "github.com/openshift/origin/pkg/apps/apis/apps"
+	appsclientinternal "github.com/openshift/origin/pkg/apps/generated/internalclientset"
 	"github.com/openshift/origin/pkg/oc/cli/util/clientcmd"
 	"github.com/openshift/origin/pkg/oc/experimental/ipfailover/ipfailover"
 	"github.com/openshift/origin/pkg/oc/generate/app"
@@ -86,7 +87,11 @@ func (p *KeepalivedPlugin) GetNamespace() (string, error) {
 // GetDeploymentConfig gets the deployment config associated with this IP Failover configurator plugin.
 
 func (p *KeepalivedPlugin) GetDeploymentConfig() (*appsapi.DeploymentConfig, error) {
-	appsClient, err := p.Factory.OpenshiftInternalAppsClient()
+	clientConfig, err := p.Factory.ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+	appsClient, err := appsclientinternal.NewForConfig(clientConfig)
 	if err != nil {
 		return nil, fmt.Errorf("error getting client: %v", err)
 	}
diff --git a/test/cmd/authentication.sh b/test/cmd/authentication.sh
index 1ef7776aa633..58d0172557f2 100755
--- a/test/cmd/authentication.sh
+++ b/test/cmd/authentication.sh
@@ -81,8 +81,8 @@ os::cmd::expect_success_and_text "curl -k -XPOST -H 'Content-Type: application/j
 os::cmd::expect_success_and_text "curl -k -XPOST -H 'Content-Type: application/json' -H 'Authorization: Bearer ${accesstoken}' '${API_SCHEME}://${API_HOST}:${API_PORT}/apis/authorization.openshift.io/v1/subjectaccessreviews' -d '{\"namespace\":\"${project}\",\"verb\":\"create\",\"resource\":\"pods\"}'" '"kind": "SubjectAccessReviewResponse"'
 os::cmd::expect_success_and_text "oc policy can-i create pods --token='${accesstoken}' -n '${project}' --ignore-scopes" 'yes'
 os::cmd::expect_success_and_text "oc policy can-i create pods --token='${accesstoken}' -n '${project}'" 'no'
-os::cmd::expect_success_and_text "oc policy can-i create subjectaccessreviews --token='${accesstoken}' -n '${project}'" 'no'
-os::cmd::expect_success_and_text "oc policy can-i create subjectaccessreviews --token='${accesstoken}' -n '${project}' --ignore-scopes" 'yes'
+os::cmd::expect_success_and_text "oc policy can-i create subjectaccessreviews.authorization.openshift.io --token='${accesstoken}' -n '${project}'" 'no'
+os::cmd::expect_success_and_text "oc policy can-i create subjectaccessreviews.authorization.openshift.io --token='${accesstoken}' -n '${project}' --ignore-scopes" 'yes'
 os::cmd::expect_success_and_text "oc policy can-i create pods --token='${accesstoken}' -n '${project}' --scopes='role:admin:*'" 'yes'
 os::cmd::expect_success_and_text "oc policy can-i --list --token='${accesstoken}' -n '${project}' --scopes='role:admin:*'" 'get.*pods'
 os::cmd::expect_success_and_not_text "oc policy can-i --list --token='${accesstoken}' -n '${project}'" 'get.*pods'
diff --git a/test/cmd/deployments.sh b/test/cmd/deployments.sh
index 8fa8ea9f27cc..10002ab475cc 100755
--- a/test/cmd/deployments.sh
+++ b/test/cmd/deployments.sh
@@ -159,7 +159,7 @@ os::test::junit::declare_suite_start "cmd/deployments/setdeploymenthook"
 arg="-f test/integration/testdata/test-deployment-config.yaml"
 os::cmd::expect_failure_and_text "oc set deployment-hook" "error: one or more deployment configs"
 os::cmd::expect_failure_and_text "oc set deployment-hook ${arg}" "error: you must specify one of --pre, --mid, or --post"
-os::cmd::expect_failure_and_text "oc set deployment-hook ${arg} -o yaml --pre -- mycmd" 'deploymentconfigs "test-deployment-config" not found'
+os::cmd::expect_failure_and_text "oc set deployment-hook ${arg} -o yaml --pre -- mycmd" 'deploymentconfigs.apps.openshift.io "test-deployment-config" not found'
 os::cmd::expect_success_and_text "oc set deployment-hook ${arg} --local -o yaml --post -- mycmd" 'mycmd'
 os::cmd::expect_success_and_not_text "oc set deployment-hook ${arg} --local -o yaml --post -- mycmd | oc set deployment-hook -f - --local -o yaml --post --remove" 'mycmd'
 os::cmd::expect_success "oc create ${arg}"
diff --git a/test/cmd/migrate.sh b/test/cmd/migrate.sh
index 0570f2a8c118..06b0132b3076 100755
--- a/test/cmd/migrate.sh
+++ b/test/cmd/migrate.sh
@@ -29,9 +29,9 @@ os::test::junit::declare_suite_end
 
 os::test::junit::declare_suite_start "cmd/migrate/storage_oauthclientauthorizations"
 # Create valid OAuth client
-os::cmd::expect_success_and_text     'oc create -f test/testdata/oauth/client.yaml' 'oauthclient "test-oauth-client" created'
+os::cmd::expect_success_and_text     'oc create -f test/testdata/oauth/client.yaml' 'oauthclient.oauth.openshift.io "test-oauth-client" created'
 # Create OAuth client authorization for client
-os::cmd::expect_success_and_text     'oc create -f test/testdata/oauth/clientauthorization.yaml' 'oauthclientauthorization "user1:test-oauth-client" created'
+os::cmd::expect_success_and_text     'oc create -f test/testdata/oauth/clientauthorization.yaml' 'oauthclientauthorization.oauth.openshift.io "user1:test-oauth-client" created'
 # Delete client
 os::cmd::expect_success_and_text     'oc delete oauthclient test-oauth-client' 'oauthclient.oauth.openshift.io "test-oauth-client" deleted'
 # Assert that migration/update still works even though the client authorization is no longer valid
diff --git a/test/cmd/router.sh b/test/cmd/router.sh
index e36dd4ffc14d..31b058a0f407 100755
--- a/test/cmd/router.sh
+++ b/test/cmd/router.sh
@@ -70,7 +70,7 @@ os::cmd::expect_success_and_text 'oc get dc/router -o yaml' 'readinessProbe'
 os::cmd::expect_success_and_text "oc delete svc/router" 'service "router" deleted'
 os::cmd::expect_success_and_text "oc delete dc/router" 'deploymentconfig.apps.openshift.io "router" deleted'
 # create a router and check for success with a warning about the existing clusterrolebinding
-os::cmd::expect_success_and_text "oc adm router" 'warning: clusterrolebindings "router-router-role" already exists'
+os::cmd::expect_success_and_text "oc adm router" 'warning: clusterrolebindings.authorization.openshift.io "router-router-role" already exists'
 
 # only when using hostnetwork should we force the probes to use localhost
 os::cmd::expect_success_and_not_text "oc adm router -o yaml --host-network=false" 'host: localhost'
diff --git a/test/cmd/set-liveness-probe.sh b/test/cmd/set-liveness-probe.sh
index c63693371b9e..23aef85744e5 100755
--- a/test/cmd/set-liveness-probe.sh
+++ b/test/cmd/set-liveness-probe.sh
@@ -12,7 +12,7 @@ trap os::test::junit::reconcile_output EXIT
 
 os::test::junit::declare_suite_start "cmd/set-probe-liveness"
 # This test setting a liveness probe, without warning about replication controllers whose deployment depends on deployment configs
-os::cmd::expect_success_and_text 'oc create -f pkg/oc/graph/genericgraph/test/simple-deployment.yaml' 'deploymentconfig "simple-deployment" created'
+os::cmd::expect_success_and_text 'oc create -f pkg/oc/graph/genericgraph/test/simple-deployment.yaml' 'deploymentconfig.apps.openshift.io "simple-deployment" created'
 os::cmd::expect_success_and_text 'oc status --suggest' 'dc/simple-deployment has no liveness probe'
 
 # test --local flag
diff --git a/test/extended/builds/build_pruning.go b/test/extended/builds/build_pruning.go
index f8286d9dca42..5182be87ea92 100644
--- a/test/extended/builds/build_pruning.go
+++ b/test/extended/builds/build_pruning.go
@@ -310,7 +310,7 @@ var _ = g.Describe("[Feature:Builds][pruning] prune builds based on settings in
 		g.It("[Conformance] buildconfigs should not have a default history limit set when created via the legacy api", func() {
 
 			g.By("creating a build config with the legacy api")
-			err := oc.Run("create").Args("-f", legacyBuildConfig).Execute()
+			err := oc.Run("create").Args("-f", legacyBuildConfig, "--raw=/oapi/v1/namespaces/"+oc.Namespace()+"/buildconfigs").Execute()
 			o.Expect(err).NotTo(o.HaveOccurred())
 
 			buildConfig, err := oc.BuildClient().Build().BuildConfigs(oc.Namespace()).Get("myphp", metav1.GetOptions{})
diff --git a/test/extended/testdata/bindata.go b/test/extended/testdata/bindata.go
index ffee4085e60e..344b616d1a3f 100644
--- a/test/extended/testdata/bindata.go
+++ b/test/extended/testdata/bindata.go
@@ -554,23 +554,31 @@ func testExtendedTestdataBuildsBuildPruningDefaultGroupBuildConfigYaml() (*asset
 	return a, nil
 }
 
-var _testExtendedTestdataBuildsBuildPruningDefaultLegacyBuildConfigYaml = []byte(`apiVersion: v1
-kind: BuildConfig
-metadata:
-  name: myphp
-spec:
-  source:
-    type: Git
-    git:
-      uri: 'https://github.com/openshift/cakephp-ex.git'
-  strategy:
-    type: Source
-    sourceStrategy:
-      from:
-        kind: ImageStreamTag
-        namespace: openshift
-        name: 'php:7.0'
-`)
+var _testExtendedTestdataBuildsBuildPruningDefaultLegacyBuildConfigYaml = []byte(`{
+  "apiVersion": "v1",
+  "kind": "BuildConfig",
+  "metadata": {
+    "name": "myphp"
+  },
+  "spec": {
+    "source": {
+      "type": "Git",
+      "git": {
+        "uri": "https://github.com/openshift/cakephp-ex.git"
+      }
+    },
+    "strategy": {
+      "type": "Source",
+      "sourceStrategy": {
+        "from": {
+          "kind": "ImageStreamTag",
+          "namespace": "openshift",
+          "name": "php:7.0"
+        }
+      }
+    }
+  }
+}`)
 
 func testExtendedTestdataBuildsBuildPruningDefaultLegacyBuildConfigYamlBytes() ([]byte, error) {
 	return _testExtendedTestdataBuildsBuildPruningDefaultLegacyBuildConfigYaml, nil
diff --git a/test/extended/testdata/builds/build-pruning/default-legacy-build-config.yaml b/test/extended/testdata/builds/build-pruning/default-legacy-build-config.yaml
index 78a3d92f843b..0e65710a4a8b 100644
--- a/test/extended/testdata/builds/build-pruning/default-legacy-build-config.yaml
+++ b/test/extended/testdata/builds/build-pruning/default-legacy-build-config.yaml
@@ -1,16 +1,25 @@
-apiVersion: v1
-kind: BuildConfig
-metadata:
-  name: myphp
-spec:
-  source:
-    type: Git
-    git:
-      uri: 'https://github.com/openshift/cakephp-ex.git'
-  strategy:
-    type: Source
-    sourceStrategy:
-      from:
-        kind: ImageStreamTag
-        namespace: openshift
-        name: 'php:7.0'
+{
+  "apiVersion": "v1",
+  "kind": "BuildConfig",
+  "metadata": {
+    "name": "myphp"
+  },
+  "spec": {
+    "source": {
+      "type": "Git",
+      "git": {
+        "uri": "https://github.com/openshift/cakephp-ex.git"
+      }
+    },
+    "strategy": {
+      "type": "Source",
+      "sourceStrategy": {
+        "from": {
+          "kind": "ImageStreamTag",
+          "namespace": "openshift",
+          "name": "php:7.0"
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/integration/etcd_storage_path_test.go b/test/integration/etcd_storage_path_test.go
index 4337a7818d57..45569190aa7f 100644
--- a/test/integration/etcd_storage_path_test.go
+++ b/test/integration/etcd_storage_path_test.go
@@ -1067,8 +1067,12 @@ func TestEtcd3StoragePath(t *testing.T) {
 
 		mapping, err := mapper.RESTMapping(gvk.GroupKind(), gvk.Version)
 		if err != nil {
-			t.Errorf("unexpected error getting mapping for %s from %s with GVK %s: %v", kind, pkgPath, gvk, err)
-			continue
+			t.Logf("unexpected error getting mapping for %s from %s with GVK %s: %v", kind, pkgPath, gvk, err)
+			mapping, err = legacyscheme.Registry.RESTMapper().RESTMapping(gvk.GroupKind(), gvk.Version)
+			if err != nil {
+				t.Errorf("unexpected error getting mapping for %s from %s with GVK %s: %v", kind, pkgPath, gvk, err)
+				continue
+			}
 		}
 
 		gvResource := gvk.GroupVersion().WithResource(mapping.Resource)
diff --git a/test/testdata/bootstrappolicy/cluster_admin_without_apigroups.yaml b/test/testdata/bootstrappolicy/cluster_admin_without_apigroups.yaml
index c7446d729034..03e71ebd37c8 100644
--- a/test/testdata/bootstrappolicy/cluster_admin_without_apigroups.yaml
+++ b/test/testdata/bootstrappolicy/cluster_admin_without_apigroups.yaml
@@ -7,6 +7,7 @@ metadata:
 rules:
 - apiGroups:
   - ''  # Allow mutation of Origin policy so we can proxy to RBAC
+  - 'authorization.openshift.io'  # Allow mutation of openshift authoriation groupified so we can proxy to RBAC
   - 'rbac.authorization.k8s.io'  # Allow mutation of RBAC so we can test escalation
   attributeRestrictions: null
   resources:
diff --git a/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/run.go b/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/run.go
index 024d35a0a61f..7573c38784d5 100644
--- a/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/run.go
+++ b/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/run.go
@@ -604,6 +604,7 @@ func createGeneratedObject(f cmdutil.Factory, cmd *cobra.Command, generator kube
 		return nil, err
 	}
 	groupVersionKind := groupVersionKinds[0]
+	cmdutil.FixOAPIGroupifiedGVK(&groupVersionKind)
 
 	if len(overrides) > 0 {
 		codec := runtime.NewCodec(cmdutil.InternalVersionJSONEncoder(), cmdutil.InternalVersionDecoder())
diff --git a/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/util/factory_client_access.go b/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/util/factory_client_access.go
index 5b553222dd89..f704c640a1d6 100644
--- a/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/util/factory_client_access.go
+++ b/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/util/factory_client_access.go
@@ -111,6 +111,11 @@ func (f *discoveryFactory) DiscoveryClient() (discovery.CachedDiscoveryInterface
 		return nil, err
 	}
 
+	// The more groups you have, the more discovery requests you need to make.
+	// given 25 groups (our groups + a few custom resources) with one-ish version each, discovery needs to make 50 requests
+	// double it just so we don't end up here again for a while.  This config is only used for discovery.
+	cfg.Burst = 100
+
 	if f.cacheDir != "" {
 		wt := cfg.WrapTransport
 		cfg.WrapTransport = func(rt http.RoundTripper) http.RoundTripper {
diff --git a/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/util/patch_oapi_gvk.go b/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/util/patch_oapi_gvk.go
new file mode 100644
index 000000000000..faa7cc6e8253
--- /dev/null
+++ b/vendor/k8s.io/kubernetes/pkg/kubectl/cmd/util/patch_oapi_gvk.go
@@ -0,0 +1,13 @@
+package util
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var OAPIToGroupifiedGVK func(gvk *schema.GroupVersionKind)
+
+func FixOAPIGroupifiedGVK(gvk *schema.GroupVersionKind) {
+	if OAPIToGroupifiedGVK != nil {
+		OAPIToGroupifiedGVK(gvk)
+	}
+}
diff --git a/vendor/k8s.io/kubernetes/pkg/kubectl/resource/mapper.go b/vendor/k8s.io/kubernetes/pkg/kubectl/resource/mapper.go
index 6739736805d7..8263596e22d0 100644
--- a/vendor/k8s.io/kubernetes/pkg/kubectl/resource/mapper.go
+++ b/vendor/k8s.io/kubernetes/pkg/kubectl/resource/mapper.go
@@ -55,6 +55,8 @@ func (m *Mapper) InfoForData(data []byte, source string) (*Info, error) {
 		return nil, fmt.Errorf("unable to decode %q: %v", source, err)
 	}
 
+	fixOAPIGroupKind(obj, gvk)
+
 	mapping, err := m.RESTMapping(gvk.GroupKind(), gvk.Version)
 	if err != nil {
 		return nil, fmt.Errorf("unable to recognize %q: %v", source, err)
@@ -96,6 +98,8 @@ func (m *Mapper) InfoForObject(obj runtime.Object, preferredGVKs []schema.GroupV
 		groupVersionKind = preferredObjectKind(groupVersionKinds, preferredGVKs)
 	}
 
+	fixOAPIGroupKind(obj, &groupVersionKind)
+
 	mapping, err := m.RESTMapping(groupVersionKind.GroupKind(), groupVersionKind.Version)
 	if err != nil {
 		return nil, fmt.Errorf("unable to recognize %v: %v", groupVersionKind, err)
diff --git a/vendor/k8s.io/kubernetes/pkg/kubectl/resource/patch_kind.go b/vendor/k8s.io/kubernetes/pkg/kubectl/resource/patch_kind.go
new file mode 100644
index 000000000000..fd40b825ab3a
--- /dev/null
+++ b/vendor/k8s.io/kubernetes/pkg/kubectl/resource/patch_kind.go
@@ -0,0 +1,14 @@
+package resource
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var OAPIToGroupified func(uncast runtime.Object, gvk *schema.GroupVersionKind)
+
+func fixOAPIGroupKind(uncast runtime.Object, gvk *schema.GroupVersionKind) {
+	if OAPIToGroupified != nil {
+		OAPIToGroupified(uncast, gvk)
+	}
+}
diff --git a/vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/discovery/patch_restmapper_kind.go b/vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/discovery/patch_restmapper_kind.go
new file mode 100644
index 000000000000..233e2b4ba132
--- /dev/null
+++ b/vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/discovery/patch_restmapper_kind.go
@@ -0,0 +1,91 @@
+package discovery
+
+import (
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var oapiResources = map[string]bool{
+	"appliedclusterresourcequotas": true,
+	"appliedclusterresourcequota":  true,
+	"buildconfigs":                 true,
+	"buildconfig":                  true,
+	"bc":                           true,
+	"builds":                       true,
+	"build":                        true,
+	"clusternetworks":              true,
+	"clusternetwork":               true,
+	"clusterresourcequotas":        true,
+	"clusterresourcequota":         true,
+	"clusterquota":                 true,
+	"clusterrolebindings":          true,
+	"clusterrolebinding":           true,
+	"clusterroles":                 true,
+	"clusterrole":                  true,
+	"deploymentconfigrollbacks":    true,
+	"deploymentconfigrollback":     true,
+	"deploymentconfigs":            true,
+	"deploymentconfig":             true,
+	"dc":                           true,
+	"egressnetworkpolicies":     true,
+	"egressnetworkpolicy":       true,
+	"groups":                    true,
+	"group":                     true,
+	"hostsubnets":               true,
+	"hostsubnet":                true,
+	"identities":                true,
+	"identity":                  true,
+	"images":                    true,
+	"image":                     true,
+	"imagesignatures":           true,
+	"imagesignature":            true,
+	"imagestreamimages":         true,
+	"imagestreamimage":          true,
+	"isimage":                   true,
+	"imagestreamimports":        true,
+	"imagestreamimport":         true,
+	"imagestreammappings":       true,
+	"imagestreammapping":        true,
+	"imagestreams":              true,
+	"imagestream":               true,
+	"is":                        true,
+	"imagestreamtags":           true,
+	"imagestreamtag":            true,
+	"istag":                     true,
+	"netnamespaces":             true,
+	"netnamespace":              true,
+	"oauthaccesstokens":         true,
+	"oauthaccesstoken":          true,
+	"oauthauthorizetokens":      true,
+	"oauthauthorizetoken":       true,
+	"oauthclientauthorizations": true,
+	"oauthclientauthorization":  true,
+	"oauthclients":              true,
+	"oauthclient":               true,
+	"processedtemplates":        true,
+	"processedtemplate":         true,
+	"projects":                  true,
+	"project":                   true,
+	"rolebindingrestrictions":   true,
+	"rolebindingrestriction":    true,
+	"rolebindings":              true,
+	"rolebinding":               true,
+	"roles":                     true,
+	"role":                      true,
+	"routes":                    true,
+	"route":                     true,
+	"securitycontextconstraints": true,
+	"securitycontextconstraint":  true,
+	"scc":                  true,
+	"templates":            true,
+	"template":             true,
+	"useridentitymappings": true,
+	"useridentitymapping":  true,
+	"users":                true,
+	"user":                 true,
+}
+
+func isOAPIResource(resource schema.GroupVersionResource) bool {
+	return oapiResources[strings.ToLower(resource.Resource)]
+}
diff --git a/vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/discovery/restmapper.go b/vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/discovery/restmapper.go
index f90e1bb0b048..a377b650cbcd 100644
--- a/vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/discovery/restmapper.go
+++ b/vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/discovery/restmapper.go
@@ -112,6 +112,13 @@ func NewRESTMapper(groupResources []*APIGroupResources, versionInterfaces meta.V
 				versionMapper.AddSpecific(gv.WithKind(strings.ToLower(resource.Kind)), plural, singular, scope)
 				// TODO this is producing unsafe guesses that don't actually work, but it matches previous behavior
 				versionMapper.Add(gv.WithKind(resource.Kind+"List"), scope)
+
+				if isOAPIResource(plural) {
+					oapiGV := schema.GroupVersion{Version: "v1"}
+					versionMapper.AddSpecific(oapiGV.WithKind(resource.Kind), plural, singular, scope)
+					// TODO this is producing unsafe guesses that don't actually work, but it matches previous behavior
+					versionMapper.Add(oapiGV.WithKind(resource.Kind+"List"), scope)
+				}
 			}
 			// TODO why is this type not in discovery (at least for "v1")
 			versionMapper.Add(gv.WithKind("List"), meta.RESTScopeRoot)