WIP: Rebase 1.32 Pre.1 Diff

pkg/controlplane/apiserver/config.go

@@ -29,7 +29,6 @@ import (
 	"github.com/kcp-dev/logicalcluster/v3"
 	noopoteltrace "go.opentelemetry.io/otel/trace/noop"
 
-	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilnet "k8s.io/apimachinery/pkg/util/net"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -150,20 +149,14 @@ func BuildGenericConfig(
 	genericConfig.LoopbackClientConfig.DisableCompression = true
 
 	kubeClientConfig := genericConfig.LoopbackClientConfig
-	clientgoExternalClient, err := clientgoclientset.NewForConfig(kubeClientConfig)
+	clusterClient, err := kcpclient.NewForConfig(kubeClientConfig)
 	if err != nil {
 		lastErr = fmt.Errorf("failed to create real external clientset: %w", err)
 		return
 	}
-	trim := func(obj interface{}) (interface{}, error) {
-		if accessor, err := meta.Accessor(obj); err == nil && accessor.GetManagedFields() != nil {
-			accessor.SetManagedFields(nil)
-		}
-		return obj, nil
-	}
-	versionedInformers = clientgoinformers.NewSharedInformerFactoryWithOptions(clientgoExternalClient, 10*time.Minute, clientgoinformers.WithTransform(trim))
+	versionedInformers = kcpinformers.NewSharedInformerFactory(clusterClient, 10*time.Minute)
 
-	if lastErr = s.Features.ApplyTo(genericConfig, clientgoExternalClient, versionedInformers); lastErr != nil {
+	if lastErr = s.Features.ApplyTo(genericConfig, clusterClient, versionedInformers); lastErr != nil {
 		return
 	}
 	if lastErr = s.APIEnablement.ApplyTo(genericConfig, resourceConfig, legacyscheme.Scheme); lastErr != nil {
@@ -216,23 +209,6 @@ func BuildGenericConfig(
 
 	ctx := wait.ContextForChannel(genericConfig.DrainedNotify())
 
-	// Use protobufs for self-communication.
-	// Since not every generic apiserver has to support protobufs, we
-	// cannot default to it in generic apiserver and need to explicitly
-	// set it in kube-apiserver.
-	genericConfig.LoopbackClientConfig.ContentConfig.ContentType = "application/vnd.kubernetes.protobuf"
-	// Disable compression for self-communication, since we are going to be
-	// on a fast local network
-	genericConfig.LoopbackClientConfig.DisableCompression = true
-
-	kubeClientConfig := genericConfig.LoopbackClientConfig
-	clusterClient, err := kcpclient.NewForConfig(kubeClientConfig)
-	if err != nil {
-		lastErr = fmt.Errorf("failed to create cluster clientset: %v", err)
-		return
-	}
-	versionedInformers = kcpinformers.NewSharedInformerFactory(clusterClient, 10*time.Minute)
-
 	// Authentication.ApplyTo requires already applied OpenAPIConfig and EgressSelector if present
 	if lastErr = s.Authentication.ApplyTo(ctx, &genericConfig.Authentication, genericConfig.SecureServing, genericConfig.EgressSelector, genericConfig.OpenAPIConfig, genericConfig.OpenAPIV3Config, clusterClient, versionedInformers, genericConfig.APIServerID); lastErr != nil {
 		return

pkg/controlplane/apiserver/samples/generic/server/server.go

@@ -134,7 +134,7 @@ func NewOptions() *options.Options {
 	s.SecureServing.ServerCert.CertDirectory = filepath.Join(wd, ".sample-minimal-controlplane")
 
 	// Wire ServiceAccount authentication without relying on pods and nodes.
-	s.Authentication.ServiceAccounts.OptionalTokenGetter = genericTokenGetter
+	s.Authentication.ServiceAccounts.OptionalTokenGetter = genericTokenClusterGetter
 
 	return s
 }

pkg/controlplane/apiserver/samples/generic/server/serviceaccounts_kcp.go

@@ -0,0 +1,60 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package server
+
+import (
+	"github.com/kcp-dev/client-go/informers"
+	kcpv1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	"github.com/kcp-dev/logicalcluster/v3"
+	v1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/kubernetes/pkg/serviceaccount"
+)
+
+// clientGetter implements ServiceAccountTokenGetter using a factory function
+type clientClusterGetter struct {
+	secretLister         kcpv1listers.SecretClusterLister
+	serviceAccountLister kcpv1listers.ServiceAccountClusterLister
+	clusterName          logicalcluster.Name
+}
+
+// genericTokenGetter returns a ServiceAccountTokenGetter that does not depend
+// on pods and nodes.
+func genericTokenClusterGetter(factory informers.SharedInformerFactory) serviceaccount.ServiceAccountTokenClusterGetter {
+	return clientClusterGetter{secretLister: factory.Core().V1().Secrets().Lister(), serviceAccountLister: factory.Core().V1().ServiceAccounts().Lister()}
+}
+
+func (c clientClusterGetter) Cluster(name logicalcluster.Name) serviceaccount.ServiceAccountTokenGetter {
+	c.clusterName = name
+	return c
+}
+
+func (c clientClusterGetter) GetServiceAccount(namespace, name string) (*v1.ServiceAccount, error) {
+	return c.serviceAccountLister.Cluster(c.clusterName).ServiceAccounts(namespace).Get(name)
+}
+
+func (c clientClusterGetter) GetPod(namespace, name string) (*v1.Pod, error) {
+	return nil, apierrors.NewNotFound(v1.Resource("pods"), name)
+}
+
+func (c clientClusterGetter) GetSecret(namespace, name string) (*v1.Secret, error) {
+	return c.secretLister.Cluster(c.clusterName).Secrets(namespace).Get(name)
+}
+
+func (c clientClusterGetter) GetNode(name string) (*v1.Node, error) {
+	return nil, apierrors.NewNotFound(v1.Resource("nodes"), name)
+}

pkg/kubeapiserver/options/authentication.go

@@ -49,7 +49,6 @@ import (
 	authenticationconfigmetrics "k8s.io/apiserver/pkg/server/options/authenticationconfig/metrics"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/apiserver/plugin/pkg/authenticator/token/oidc"
-	"k8s.io/client-go/informers"
 	"k8s.io/client-go/util/keyutil"
 	cliflag "k8s.io/component-base/cli/flag"
 	"k8s.io/klog/v2"
@@ -136,7 +135,7 @@ type ServiceAccountAuthenticationOptions struct {
 	IsTokenSignerExternal bool
 	// OptionalTokenGetter is a function that returns a service account token getter.
 	// If not set, the default token getter will be used.
-	OptionalTokenGetter func(factory informers.SharedInformerFactory) serviceaccount.ServiceAccountTokenGetter
+	OptionalTokenGetter func(factory kcpinformers.SharedInformerFactory) serviceaccount.ServiceAccountTokenClusterGetter
 	// ExternalPublicKeysGetter gets set if `--service-account-signing-endpoint` is passed.
 	// ExternalPublicKeysGetter is mutually exclusive with KeyFiles.
 	ExternalPublicKeysGetter serviceaccount.PublicKeysGetter

staging/src/k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/validation/validation.go

@@ -593,7 +593,7 @@ func hasValidConversionReviewVersionOrEmpty(versions []string) bool {
 	return false
 }
 
-func validateCustomResourceConversion(conversion *apiextensions.CustomResourceConversion, requireRecognizedVersion bool, fldPath *field.Path, opts validationOptions) field.ErrorList {
+func validateCustomResourceConversion(conversion *apiextensions.CustomResourceConversion, requireRecognizedVersion bool, fldPath *field.Path, opts ValidationOptions) field.ErrorList {
 	allErrs := field.ErrorList{}
 	if conversion == nil {
 		return allErrs
@@ -612,7 +612,7 @@ func validateCustomResourceConversion(conversion *apiextensions.CustomResourceCo
 			case cc.Service != nil:
 				allErrs = append(allErrs, webhook.ValidateWebhookService(fldPath.Child("webhookClientConfig").Child("service"), cc.Service.Name, cc.Service.Namespace, cc.Service.Path, cc.Service.Port)...)
 			}
-			if len(cc.CABundle) > 0 && !opts.allowInvalidCABundle {
+			if len(cc.CABundle) > 0 && !opts.AllowInvalidCABundle {
 				allErrs = append(allErrs, webhook.ValidateCABundle(fldPath.Child("webhookClientConfig").Child("caBundle"), cc.CABundle)...)
 			}
 		}

staging/src/k8s.io/apiserver/pkg/server/options/feature.go

@@ -21,11 +21,11 @@ import (
 
 	"github.com/spf13/pflag"
 
+	kcpinformers "github.com/kcp-dev/client-go/informers"
+	kcpclient "github.com/kcp-dev/client-go/kubernetes"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apiserver/pkg/server"
 	utilflowcontrol "k8s.io/apiserver/pkg/util/flowcontrol"
-	"k8s.io/client-go/informers"
-	"k8s.io/client-go/kubernetes"
 )
 
 type FeatureOptions struct {
@@ -61,7 +61,7 @@ func (o *FeatureOptions) AddFlags(fs *pflag.FlagSet) {
 		"If true, replace the max-in-flight handler with an enhanced one that queues and dispatches with priority and fairness")
 }
 
-func (o *FeatureOptions) ApplyTo(c *server.Config, clientset kubernetes.Interface, informers informers.SharedInformerFactory) error {
+func (o *FeatureOptions) ApplyTo(c *server.Config, clientset kcpclient.ClusterInterface, informers kcpinformers.SharedInformerFactory) error {
 	if o == nil {
 		return nil
 	}